Shortcuts & Jump Lists
Connect recent items and target paths to the relevant application, profile, and volume.
Question & scope
Windows shortcuts and application Jump Lists can provide target paths and user-specific context for recent items. They can be useful when a file has moved or disappeared, or when a game instance was launched from an unexpected directory. A shortcut describes a target and may retain metadata from the time it was created or updated. It is not a complete record of the target’s subsequent history.
Jump Lists are attached to applications and can include recent, frequent, pinned, or application-defined destinations and tasks. Identify the application association and profile before drawing conclusions from a parsed entry. Pinned or static tasks can persist without representing recent use of the target.
What to collect
| Source | Retain and examine |
|---|---|
| Shortcut files | Selected .lnk files, source locations, and filesystem metadata. |
| Jump List files | Relevant user-profile destination lists and their metadata. |
| Target information | Path, working directory, arguments, volume context, and parser-supported fields. |
| Application context | The associated application or AppID and how that association was determined. |
Examination workflow
- Collect files from the profile and instance context relevant to the session.
- Parse shortcuts and destination lists using format-aware tools such as LECmd and JLECmd.
- Keep the shortcut file’s own timestamps separate from embedded target metadata.
- Resolve drive letters using available volume information; a historical drive letter may not name the same current device.
- Compare targets and application context with game logs, filesystem changes, and independent execution artifacts.
Interpretation & false positives
A target name appearing in a link does not prove its current presence, contents, or execution. A manually created shortcut can refer to a file that was never launched. A recent destination may describe a document opened by an application, not a separate process execution.
Historical paths can contain usernames and private directory names; redact those from a public finding while retaining an unredacted evidence copy where appropriate. Exact interpretation requires distinguishing the source file, the application’s destination entry, and the target object.
Worked scenario
A shortcut names a client on drive E:, but the current E: device is a different USB stick. Compare volume identifiers and accompanying device records before attributing the target to the connected stick. Report the historical target context as recorded and leave uncertain mappings unresolved.
Report checklist
- Source and embedded target timestamps are separated.
- Application and profile associations are stated.
- Historical drive letters are not treated as permanent identities.
- Execution claims rely on more than a shortcut.
Sources & further reading
The workflow and scenario are authored investigation guidance. Confirm source-system and parser support for the build you examine.