Difference between pages "User talk:Daskalak" and "List of Jump List IDs"
From Forensics Wiki
(Difference between pages)
m (Welcome!) |
|||
| Line 1: | Line 1: | ||
| − | + | == Jump Lists == | |
| − | + | Jump Lists are a new Windows 7 Taskbar feature that gives the user quick access to recently accessed application files and actions. Jump Lists come in two flavors, automatic (autodest, or *.automaticDestinations-ms) and custom (custdest, or *.customDestinations-ms) files. Autodest files are created by the operating system | |
| − | + | ||
| − | + | Jump Lists are located in the user profile path, in the C:\Users\''user''\Recent folder. Autodest Jump Lists are located in the automaticDestinations subdirectory, and custdest files are located in the customDestinations subdirectory. | |
| + | |||
| + | |||
| + | === AutomaticDestinations === | ||
| + | Path: C:\Users\user\Recent\AutomaticDestinations | ||
| + | Files: *.automaticDestinations | ||
| + | |||
| + | Structure - The autodest files follow the [http://msdn.microsoft.com/en-us/library/dd942138%28v=prot.13%29.aspx: MS-CFB] compound file binary format specification. | ||
| + | |||
| + | |||
| + | === CustomDestinations === | ||
| + | Path: C:\Users\user\Recent\CustomDestinations | ||
| + | Files: *.customDestinations | ||
| + | |||
| + | Structure | ||
| + | |||
| + | === AppIDs === | ||
| + | |||
| + | <table border="1"> | ||
| + | <tr><td>1b4dd67f29cb1962</td><td>Explorer (task bar folder icon)</td> | ||
| + | <tr><td>1bc392b8e104a00e</td><td>Remote Desktop</td></tr> | ||
| + | <tr><td>23646679aaccfae0</td><td>Adobe Reader 9 x64</td></tr> | ||
| + | <tr><td>271e609288e1210a</td><td>Access 2010 x86</td></tr> | ||
| + | <tr><td>28c8b86deab549a1</td><td>Internet Explorer x86</td></tr> | ||
| + | <tr><td>290532160612e071</td><td>WinRar x64</td></tr> | ||
| + | <tr><td>2b53c4ddf69195fc</td><td>Zune x64</td></tr> | ||
| + | <tr><td>3094cdb43bf5e9c2</td><td>OneNote 2010 x86</td></tr> | ||
| + | <tr><td>5da8f997fd5f9428</td><td>Internet Explorer x64</td></tr> | ||
| + | <tr><td>74d7f43c1561fc1e</td><td>Windows Media Player</td></tr> | ||
| + | <tr><td>9839aec31243a928</td><td>Excel 2010 x86</td></tr> | ||
| + | <tr><td>9b9cdc69c1c24e2b</td><td>Notepad x64</td></tr> | ||
| + | <tr><td>9c7cc110ff56d1bd</td><td>PowerPoint 2010 x86</td></tr> | ||
| + | <tr><td>a7bd71699cd38d1c</td><td>Word 2010 x86</td></tr> | ||
| + | <tr><td>b8c29862d9f95832</td><td>InfoPath 2010 x86</td></tr> | ||
| + | <tr><td>b91050d8b077a4e8</td><td>Windows Media Center x64</td></tr> | ||
| + | <tr><td>be71009ff8bb02a2</td><td>Outlook x86</td></tr> | ||
| + | <tr><td>d64d36b238c843a3</td><td>InfoPath 2010 x86</td></tr> | ||
| + | <tr><td>e36bfc8972e5ab1d</td><td>XPS Viewer</td></tr> | ||
| + | <tr><td>17d3eb086439f0d7</td><td>TrueCrypt 7.0a</td></tr> | ||
| + | <tr><td>adecfb853d77462a</td><td>MSWord 2007</td></tr> | ||
| + | <tr><td>c71ef2c372d322d7</td><td>PGP Desktop 10</td></tr> | ||
| + | <tr><td>cdf30b95c55fd785</td><td>MSExcel 2007</td></tr> | ||
| + | <tr><td>f5ac5390b9115fdb</td><td>MSPowerPoint 2007</td></tr> | ||
| + | <tr><td>12dc1ea8e34b5a6</td><td>MSPaint 6.1</td></tr> | ||
| + | <tr><td>431a5b43435cc60b</td><td>Python (.pyc)</td></tr> | ||
| + | <tr><td>469e4a7982cea4d4</td><td>? (.job)</td></tr> | ||
| + | <tr><td>500b8c1d5302fc9c</td><td>(.pyw)</td></tr> | ||
| + | <tr><td>50620fe75ee0093</td><td>VMWare Player 3.1.4</td></tr> | ||
| + | <tr><td>65009083bfa6a094</td><td>(app launched via XPMode)</td></tr> | ||
| + | <tr><td>7e4dca80246863e3</td><td>Control Panel</td></tr> | ||
| + | <tr><td>83b03b46dcd30a0e</td><td>iTunes 10</td></tr> | ||
| + | <tr><td>b0459de4674aab56</td><td>(.vmcx)</td></tr> | ||
| + | </table> | ||
Revision as of 09:08, 23 August 2011
Contents |
Jump Lists
Jump Lists are a new Windows 7 Taskbar feature that gives the user quick access to recently accessed application files and actions. Jump Lists come in two flavors, automatic (autodest, or *.automaticDestinations-ms) and custom (custdest, or *.customDestinations-ms) files. Autodest files are created by the operating system
Jump Lists are located in the user profile path, in the C:\Users\user\Recent folder. Autodest Jump Lists are located in the automaticDestinations subdirectory, and custdest files are located in the customDestinations subdirectory.
AutomaticDestinations
Path: C:\Users\user\Recent\AutomaticDestinations Files: *.automaticDestinations
Structure - The autodest files follow the MS-CFB compound file binary format specification.
CustomDestinations
Path: C:\Users\user\Recent\CustomDestinations Files: *.customDestinations
Structure
AppIDs
| 1b4dd67f29cb1962 | Explorer (task bar folder icon) |
| 1bc392b8e104a00e | Remote Desktop |
| 23646679aaccfae0 | Adobe Reader 9 x64 |
| 271e609288e1210a | Access 2010 x86 |
| 28c8b86deab549a1 | Internet Explorer x86 |
| 290532160612e071 | WinRar x64 |
| 2b53c4ddf69195fc | Zune x64 |
| 3094cdb43bf5e9c2 | OneNote 2010 x86 |
| 5da8f997fd5f9428 | Internet Explorer x64 |
| 74d7f43c1561fc1e | Windows Media Player |
| 9839aec31243a928 | Excel 2010 x86 |
| 9b9cdc69c1c24e2b | Notepad x64 |
| 9c7cc110ff56d1bd | PowerPoint 2010 x86 |
| a7bd71699cd38d1c | Word 2010 x86 |
| b8c29862d9f95832 | InfoPath 2010 x86 |
| b91050d8b077a4e8 | Windows Media Center x64 |
| be71009ff8bb02a2 | Outlook x86 |
| d64d36b238c843a3 | InfoPath 2010 x86 |
| e36bfc8972e5ab1d | XPS Viewer |
| 17d3eb086439f0d7 | TrueCrypt 7.0a |
| adecfb853d77462a | MSWord 2007 |
| c71ef2c372d322d7 | PGP Desktop 10 |
| cdf30b95c55fd785 | MSExcel 2007 |
| f5ac5390b9115fdb | MSPowerPoint 2007 |
| 12dc1ea8e34b5a6 | MSPaint 6.1 |
| 431a5b43435cc60b | Python (.pyc) |
| 469e4a7982cea4d4 | ? (.job) |
| 500b8c1d5302fc9c | (.pyw) |
| 50620fe75ee0093 | VMWare Player 3.1.4 |
| 65009083bfa6a094 | (app launched via XPMode) |
| 7e4dca80246863e3 | Control Panel |
| 83b03b46dcd30a0e | iTunes 10 |
| b0459de4674aab56 | (.vmcx) |
