RSS Feed

Jumplist Data

Created: 02.06.2023

The Windows 7-10 taskbar (Jump List) is engineered to allow users to “jump” or access items they have frequently or recently used quickly and easily. This functionality not only includes recent media files; it must also include recent tasks. The data stored in the AutomaticDestinations folder will each have a unique file prepended with the AppID of the associated application.

🔑 NTUSER.DAT\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\JumplistData. 📂 %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations

⏰ Timestamps

First time of execution of application: Creation Time = the first time the item was added to the AppID file. Last time of execution of application w/file open: Modification Time = the last time the item was added to the AppID file.

🛠️ Can be analysed with a LNK parser.

Shows applications accessed.


Expand… Jumplist IDs: http://www.forensicswiki.org/wiki/List_of_Jump_List_IDs.