Jump Lists Forensics Cheat Sheet

What it is

Jump Lists, introduced in Windows 7, are the per-application menus of recent, frequent and pinned items shown when a user right-clicks a taskbar or Start menu icon. Windows keeps one file per application, named after its AppID. Each file holds LNK-format records of the items used with that application, so Jump Lists add what a plain LNK lacks: which program opened the file, plus usage metadata kept in the DestList stream.

Location

Windows version	Path	Format
7 / 8 / 10 / 11	`C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\<AppID>.automaticDestinations-ms`	OLE compound file: one `DestList` stream plus one LNK stream per entry
7 / 8 / 10 / 11	`C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\<AppID>.customDestinations-ms`	Concatenated LNK entries grouped in categories, no `DestList`

The AppID is 16 hexadecimal characters derived from the application (for example 9b9cdc69c1c24e2b for 64-bit Notepad, 5f7b5f1e01b83767 for Quick Access, 1bc392b8e104a00e for Remote Desktop Connection). Public AppID lists map most common programs; the same program can have several AppIDs across versions and architectures.

What it proves

File access tied to an application: a document appears in the Jump List of Word, Notepad, VLC or 7-Zip, showing which program the user opened it with.
When and how often: last access time per entry, and an access count on Windows 10 and later.
User intent: pinned entries were deliberately kept by the user.
Remote access: the Remote Desktop Connection Jump List lists hosts the user connected to (see RDP connections).
Each embedded LNK carries the target path, volume serial number, drive type and target timestamps, like a standalone LNK file.
It does not prove the content was read or modified, and CustomDestinations entries (tasks, pinned sites) may be defined by the application rather than used by the person.

Key fields

Field	Meaning
AppID (file name)	Identifies the application that owns the list
`DestList` header: version	1 on Windows 7, 3 or 4 on Windows 10 and later
`DestList` header: entry counts	Number of entries, number of pinned entries, last entry number
Entry number	Links a `DestList` entry to its LNK stream (stream name is the entry number in hex)
Last access time	When the item was last used with this application (FILETIME)
Pin status	`-1` = not pinned; 0 or higher = pinned position
Access count	Number of uses (DestList version 3 and later, Windows 10+)
Hostname	NetBIOS name of the machine where the item was recorded
Droid identifiers	Volume and file object IDs, as in the LNK TrackerDataBlock (MAC address)
Path	Full path or URL of the item

Timestamps

Timestamp	Set when	Format	Pitfalls
`DestList` last access	The item was opened with this application	FILETIME, UTC	The most reliable per-entry time; one value only, previous uses are only reflected in the count
Embedded LNK target times	Copied from the target when the entry was written	FILETIME, UTC	Describe the target file, not the user action
Jump List file creation ($SI)	First item recorded for this AppID	NTFS, UTC	Not tied to a specific entry
Jump List file modification ($SI)	Last update of the list	NTFS, UTC	Matches the newest DestList activity, not every entry

Retention and clearing

Entries roll over as the application's list grows; pinned items are kept. Each application manages its own list, so a busy program loses old entries faster than a rarely used one.
Removing an item from the list ("Remove from this list"), clearing File Explorer history or setting Start_TrackDocs to 0 (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced) removes entries or stops new ones.
Uninstalling an application does not necessarily delete its Jump List, which can outlive the program.
Deleted .automaticDestinations-ms files or streams may be recovered from volume shadow copies, the $MFT or unallocated space.

Collection

KAPE target: JumpLists (both folders), also covered by LNKFilesAndJumpLists.
Velociraptor (Windows.Triage.Targets): JumpLists or LNKFilesAndJumpLists. Windows.Forensics.JumpLists parses AutomaticDestinations live.
Built-in: the files are not locked; copy both folders with their timestamps:

robocopy "C:\Users\alice\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations" E:\case\alice\AutomaticDestinations /COPY:DAT /DCOPY:T
robocopy "C:\Users\alice\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" E:\case\alice\CustomDestinations /COPY:DAT /DCOPY:T

Parsing tools

JLECmd (Eric Zimmerman, free): JLECmd.exe -d E:\case --csv E:\out parses both Jump List types, resolves AppIDs and outputs DestList data with the full embedded LNK details.
libolecf (Joachim Metz, open source): reads the OLE container; the dtformats project documents the Jump List and DestList formats.
Velociraptor: Windows.Forensics.JumpLists, with a built-in AppID table.
Plaso: olecf_automatic_destinations (OLECF plugin) and custom_destinations parsers for super timelines.

Investigation tips

Start with the AppIDs present: an AppID for rclone, WinSCP, 7-Zip or a remote-access tool is a lead in itself, even before reading the entries.
The Remote Desktop Connection list (1bc392b8e104a00e) is a quick way to spot lateral movement destinations from the user's point of view.
Filter entries whose embedded LNK shows a removable drive and pivot on the volume serial number to tie documents to a USB device.
Use the access count (Windows 10+) to separate a one-off opening from habitual use of a document.
Correlate with LNK files, RecentDocs and ShellBags: Jump Lists often keep entries after the Recent LNK has been overwritten.
A hostname in DestList different from the examined machine can indicate a copied or roaming profile.

Jump Lists

Tools