Jump Lists

Location & availability

AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations and CustomDestinations

Coverage depends on application integration, Windows settings and retention. An application identifier needs reliable resolution.

Fields to examine

• Application identifier and destination information.
• Embedded LNK target metadata where present.
• DestList fields and ordering only when the format provides them.

What it can establish

• Support an application/destination association in the retained data.

What it cannot prove

• Prove that every listed file was read by a human or executed.
• Treat custom application tasks as a complete chronological file-open log.

Use it in a screenshare

1. Identify the user profile and acquire both relevant destination-file types.
2. Parse using JLECmd and check whether the row comes from a DestList entry, embedded link or custom task.
3. Compare the target identity with LNK files, RecentDocs and application-specific logs. Keep ordering and timestamp semantics separate.

Worked example

An archive utility’s Jump List contains a destination matching a downloaded archive. This supports a useful association. Confirm extraction through resulting files or journal changes before saying that the archive’s payload was run.

Cross-check the finding

• LNK shortcuts →Support a stored shortcut-to-target relationship.
• RecentDocs →Support a retained recent-document association in a profile.
• Browser download records →Support a recorded transfer attempt and, when recorded, its completion state.

Sources

• JLECmd — Jump List parser ↗
• Microsoft — Jump Lists ↗