Jump Lists - Revision history

Joachim Metz: /* Structure */

2013-02-12T06:25:59Z

‎Structure

2013-02-10T14:29:02Z

‎Structure

2013-02-10T14:24:51Z

‎External Links

2013-02-10T14:23:03Z

‎Tools

2013-02-10T14:22:32Z

‎Structure

2013-02-10T14:20:41Z

‎Tools

2013-02-10T14:15:03Z

‎External Links

2013-02-10T14:13:36Z

‎Tools

2013-02-10T14:12:47Z

‎External Links

2013-02-10T14:09:17Z

‎External Links

@@ Line 30: / Line 30: @@
 * DestList
-Each of the hexadecimal numbered streams contains data similar of that of a [[LNK|Windows Shortcut]]. One could extract all the streams and analyze them individually with a LNK parser.
+Each of the hexadecimal numbered streams contains data similar of that of a [[LNK|Windows Shortcut (LNK)]]. One could extract all the streams and analyze them individually with a LNK parser.
 The "DestList" stream acts as a most recently/frequently used (MRU/MFU) list. This stream consists of a 32-byte header, followed by the various structures that correspond to each of the individual numbered streams.  Each of these structures is 114 bytes in size, followed by a variable length Unicode string. The first 114 bytes of the structure contains the following information at the corresponding offsets:

@@ Line 30: / Line 30: @@
 * DestList
-Each of the hexadecimal numbered streams contains data similar of that of a [[LNK|Windows Shortcut]]. One could extract all the streams and analyze them with a LNK parser.
+Each of the hexadecimal numbered streams contains data similar of that of a [[LNK|Windows Shortcut]]. One could extract all the streams and analyze them individually with a LNK parser.
 The "DestList" stream acts as a most recently/frequently used (MRU/MFU) list. This stream consists of a 32-byte header, followed by the various structures that correspond to each of the individual numbered streams.  Each of these structures is 114 bytes in size, followed by a variable length Unicode string. The first 114 bytes of the structure contains the following information at the corresponding offsets:

@@ Line 57: / Line 57: @@
 == External Links ==
 * [http://www.codeproject.com/Articles/36561/Windows-7-Goodies-in-C-Jump-Lists Windows 7 Goodies in C++: Jump Lists], by [[Michael Dunn]], May 19, 2009
 * [http://www.alexbarnett.com/jumplistforensics.pdf The Forensic Value of the Windows 7 Jump List], by [[Alexander G Barnett]], April 18, 2011
 * [http://www.slideshare.net/ctin/windows-7-forensics-jump-listsrv3public Forensic Examination of Windows 7 Jump Lists], by [[Troy Larson]], June 6, 2011

@@ Line 65: / Line 65: @@
 == Tools ==
 * [http://tzworks.net/prototype_page.php?proto_id=20 TZWorks LLC: Windows Jump List Parser (jmp)]. Also has a tool that can parse both the custom and automatic Destinations type files. For automaticDestinations it associates the MRU/MFU metadata with that of the SHLLINK metadata. There are versions of the tool that can run in Windows, Linux or Mac OS-X.
 [[Category:Windows]]

@@ Line 30: / Line 30: @@
 * DestList
-Each of the hexadecimal numbered streams contains data similar of that of a [[LNK|Windows Shortcut]].
+Each of the hexadecimal numbered streams contains data similar of that of a [[LNK|Windows Shortcut]]. One could extract all the streams and analyze them with a LNK parser.
 The "DestList" stream acts as a most recently/frequently used (MRU/MFU) list. This stream consists of a 32-byte header, followed by the various structures that correspond to each of the individual numbered streams.  Each of these structures is 114 bytes in size, followed by a variable length Unicode string. The first 114 bytes of the structure contains the following information at the corresponding offsets:

@@ Line 65: / Line 65: @@
 == Tools ==
-* Autodest files can be opened in tools such as the [http://mitec.cz/ssv.html: MiTec Structured Storage Viewer], and each of the streams individually/manually extracted.  Each of the extracted numbered streams can then be viewed via the [http://mitec.cz/wfa.html: Windows File Analyzer].
+* [http://www.woanware.co.uk/?p=265 Woanware: JumpLister]. Tool to view the information within the numbered streams of each autodest file.
-* Another approach would be to use Mark Woan's [http://www.woanware.co.uk/?p=265: JumpLister] tool to view the information within the numbered streams of each autodest file.
+* [http://tzworks.net/prototype_page.php?proto_id=20 TZWorks LLC: Windows Jump List Parser (jmp)]. Also has a tool that can parse both the custom and automatic Destinations type files. For automaticDestinations it associates the MRU/MFU metadata with that of the SHLLINK metadata. There are versions of the tool that can run in Windows, Linux or Mac OS-X.
-* TZWorks LLC [http://tzworks.net/prototype_page.php?proto_id=20 Jump List Parser (jmp)] also has a tool that can parse both the custom and automatic Destinations type files.  For automaticDestinations it associates the MRU/MFU metadata with that of the SHLLINK metadata. There are versions of the tool that can run in Windows, Linux or Mac OS-X.
-* [http://www.woanware.co.uk/?p=265 Woanware: JumpLister]
 [[Category:Windows]]

@@ Line 58: / Line 58: @@
 * [http://www.codeproject.com/Articles/36561/Windows-7-Goodies-in-C-Jump-Lists Windows 7 Goodies in C++: Jump Lists], by [[Michael Dunn]], May 19, 2009
 * [http://www.alexbarnett.com/jumplistforensics.pdf The Forensic Value of the Windows 7 Jump List], by [[Alexander G Barnett]], April 18, 2011
 * [http://windowsir.blogspot.ch/2011/08/jump-list-analysis.html Jump List Analysis], by [[Harlan Carvey]], August 17, 2011
 * [http://windowsir.blogspot.ch/2011/08/jump-list-analysis-pt-ii.html Jump List Analysis, pt II], by [[Harlan Carvey]], August 24, 2011

← Older revision		Revision as of 14:09, 10 February 2013
Line 56:		Line 56:

	== External Links ==		== External Links ==
		+	* [http://www.codeproject.com/Articles/36561/Windows-7-Goodies-in-C-Jump-Lists Windows 7 Goodies in C++: Jump Lists], by [[Michael Dunn]], May 19, 2009
		+	* [http://windowsir.blogspot.ch/2011/08/jump-list-analysis.html Jump List Analysis], by [[Harlan Carvey]], August 17, 2011
		+	* [http://windowsir.blogspot.ch/2011/08/jump-list-analysis-pt-ii.html Jump List Analysis, pt II], by [[Harlan Carvey]], August 24, 2011
		+	* [http://windowsir.blogspot.ch/2011/12/jump-list-analysis.html Jump List Analysis], by [[Harlan Carvey]], December 28, 2011
		+	* [http://articles.forensicfocus.com/2012/10/30/forensic-analysis-of-windows-7-jump-lists/ Forensic Analysis of Windows 7 Jump Lists], by [[Rob Lyness]], October 2012

	== Tools ==		== Tools ==