When did Windows add Jump Lists?

Jump Lists shipped with Windows 7 in 2009 and are still present, in the same on-disk formats, in Windows 10 and Windows 11.

Where are Jump Lists shown in the Windows UI?

Right-click a taskbar icon, or hover a pinned app in the Start Menu. The flyout that lists Recent, Frequent, Pinned, and app-defined entries is the Jump List.

What is the difference between Automatic and Custom Destinations?

AutomaticDestinations are tracked by Windows itself as an OLE Compound File of LNK streams ordered by a DestList. CustomDestinations are written by the application and contain a flat sequence of LNK structures grouped into categories.

What Is a Windows Jump List? A Beginner's Guide

Q: What is a Windows Jump List?

A Jump List is a per-application menu of recently and frequently used items that Windows surfaces from the Start Menu and taskbar, backed by files on disk under the user's AppData.

A Windows Jump List is a per-application menu of recently used, frequently used, and pinned items that Windows surfaces from the taskbar and Start Menu. It shipped in Windows 7 and the on-disk format has not changed through Windows 10 and 11. Each Jump List is also a file on disk that records what a user opened with which application, when, and from where. That last fact is why DFIR analysts care about an artifact most users will never name.

What you see in the UI

Right-click any taskbar icon — Notepad, Word, Explorer, Chrome — and the flyout that appears is that application's Jump List. The same menu shows up next to pinned tiles in the Start Menu. Sections vary by app: Pinned, Recent, Frequent, plus any application-defined groups (Chrome's Most visited, Word's Recent Documents, VS Code's Recent Workspaces).

There are two authors writing to the same folder. Windows itself tracks recent and frequent items for every registered application. The application can also publish its own categories using the ICustomDestinationList shell API. Both end up on disk in the same place, in two different file formats.

How Windows builds them

Each application that wants a Jump List registers an AppID — a 16-character lowercase hex string like 1b4dd67f29cb1962, computed as a truncated CRC64 over the executable path. Same binary at the same path produces the same AppID on every machine, which is what makes published AppID lists useful for analyst work.

Whenever the user opens a file through that application, the Windows shell writes a Windows Shell Link (.lnk) into the corresponding Jump List file. The LNK captures the target path, file size, three FILETIME timestamps, the volume serial number, and — through its TrackerDataBlock — the NetBIOS hostname of the originating machine and a droid GUID derived from its MAC address.

Two file types, one folder

Both live under %AppData%\Microsoft\Windows\Recent\ and use the <AppID>.<extension> naming:

AutomaticDestinations (*.automaticDestinations-ms) — written by Windows. The container is an OLE Compound File (MS-CFB, the same format as a legacy .doc). Each numbered stream is an embedded LNK; a special DestList stream orders them and records per-entry access timestamps, access counts, entry IDs, and the source hostname.
CustomDestinations (*.customDestinations-ms) — written by the application. The container is a flat binary blob: a header, then a sequence of LNK structures grouped into named categories, terminated by 0xBABFFBAB.

Practical version: AutomaticDestinations is what Windows tells you the user did. CustomDestinations is what the application tells you it wanted to offer.

What's actually inside one entry

Decoding a single Jump List entry typically yields:

The full target path of the file or URL opened.
File metadata at the time of opening — size, MAC times, attributes.
The volume serial number and drive type, useful for fingerprinting removable media.
A TrackerDataBlock containing the machine's NetBIOS name and a MAC-address-derived droid GUID.
For AutomaticDestinations, the access timestamp and access count from the DestList stream.
Command-line arguments and working directory if the LNK carried them.

Together those fields turn a Jump List into a per-user timeline of file interaction that survives even after the original file is deleted.

Why DFIR analysts care

Jump Lists answer a question few other artifacts answer cleanly: which application opened which file, on which host, at which time. They corroborate ShellBags, Recent Items, Prefetch, AmCache and browser history, and they often preserve references to files on USB drives or network shares that no longer exist. The hostname field in DestList is especially useful for lateral-movement work — a workstation's Jump List will remember the staging server's NetBIOS name long after the share is gone.

To go past the primer and read the bytes yourself, the follow-up post on understanding Windows Jump Lists walks through both formats in detail.