The Windows 7-10 taskbar (Jump List) is engineered to allow users to “jump” or access items they have frequently or recently used quickly and easily. This functionality not only includes recent media files; it must also include recent tasks. The data stored in the AutomaticDestinations folder will each have a unique file prepended with the AppID of the associated application.
🔑 NTUSER.DAT\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\JumplistData.
📂 %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations
⏰ Timestamps
First time of execution of application: Creation Time = the first time the item was added to the AppID file. Last time of execution of application w/file open: Modification Time = the last time the item was added to the AppID file.
🛠️ Can be analysed with a LNK parser.
Shows applications accessed.