Difference between pages "List of Jump List IDs" and "Compression"

From ForensicsWiki
(Difference between pages)
Jump to: navigation, search
 
(LZXPRESS)
 
Line 1: Line 1:
== Jump Lists ==
+
{{Expand}}
Jump Lists are a new Windows 7 Taskbar feature that gives the user quick access to recently accessed application files and actions.  Jump Lists come in two flavors, automatic (autodest, or *.automaticDestinations-ms) and custom (custdest, or *.customDestinations-ms) files.  Autodest files are created by the operating system
+
  
Jump Lists are located in the user profile path, in the C:\Users\''user''\Recent folder.  Autodest Jump Lists are located in the automaticDestinations subdirectory, and custdest files are located in the customDestinations subdirectory.
+
== LZ-based ==
  
 +
=== LZNT1 ===
 +
Used in:
 +
* [[NTFS]]
 +
* [[Windows SuperFetch Format]]
  
=== AutomaticDestinations ===
+
=== LZXPRESS ===
Path: C:\Users\user\Recent\AutomaticDestinations
+
Used in:
Files: *.automaticDestinations
+
* [[Extensible Storage Engine (ESE) Database File (EDB) format]]
  
Structure - The autodest files follow the [http://msdn.microsoft.com/en-us/library/dd942138%28v=prot.13%29.aspx: MS-CFB] compound file binary format specification. 
+
=== LZXPRESS Huffman ===
 +
Used in:
 +
* [[Windows SuperFetch Format]]
  
 +
== External Links ==
 +
* [http://en.wikipedia.org/wiki/Lempel-Ziv Wikipedia: Lempel-Ziv]
 +
* [http://www.coderforlife.com/microsoft-compression-formats/ Microsoft Compression Formats]
  
=== CustomDestinations ===
+
=== LZ1 ===
Path: C:\Users\user\Recent\CustomDestinations
+
* [http://andyh.org/LZ1.html LZ1]
Files: *.customDestinations
+
 
+
Structure
+
 
+
=== AppIDs ===
+
 
+
<table border="1">
+
<tr><td>1b4dd67f29cb1962</td><td>Explorer (task bar folder icon)</td>
+
<tr><td>1bc392b8e104a00e</td><td>Remote Desktop</td></tr>
+
<tr><td>23646679aaccfae0</td><td>Adobe Reader 9 x64</td></tr>
+
<tr><td>271e609288e1210a</td><td>Access 2010 x86</td></tr>
+
<tr><td>28c8b86deab549a1</td><td>Internet Explorer x86</td></tr>
+
<tr><td>290532160612e071</td><td>WinRar x64</td></tr>
+
<tr><td>2b53c4ddf69195fc</td><td>Zune x64</td></tr>
+
<tr><td>3094cdb43bf5e9c2</td><td>OneNote 2010 x86</td></tr>
+
<tr><td>5da8f997fd5f9428</td><td>Internet Explorer x64</td></tr>
+
<tr><td>74d7f43c1561fc1e</td><td>Windows Media Player</td></tr>
+
<tr><td>9839aec31243a928</td><td>Excel 2010 x86</td></tr>
+
<tr><td>9b9cdc69c1c24e2b</td><td>Notepad x64</td></tr>
+
<tr><td>9c7cc110ff56d1bd</td><td>PowerPoint 2010 x86</td></tr>
+
<tr><td>a7bd71699cd38d1c</td><td>Word 2010 x86</td></tr>
+
<tr><td>b8c29862d9f95832</td><td>InfoPath 2010 x86</td></tr>
+
<tr><td>b91050d8b077a4e8</td><td>Windows Media Center  x64</td></tr>
+
<tr><td>be71009ff8bb02a2</td><td>Outlook x86</td></tr>
+
<tr><td>d64d36b238c843a3</td><td>InfoPath 2010 x86</td></tr>
+
<tr><td>e36bfc8972e5ab1d</td><td>XPS Viewer</td></tr>
+
<tr><td>17d3eb086439f0d7</td><td>TrueCrypt 7.0a</td></tr>
+
<tr><td>adecfb853d77462a</td><td>MSWord 2007</td></tr>
+
<tr><td>c71ef2c372d322d7</td><td>PGP Desktop 10</td></tr>
+
<tr><td>cdf30b95c55fd785</td><td>MSExcel 2007</td></tr>
+
<tr><td>f5ac5390b9115fdb</td><td>MSPowerPoint 2007</td></tr>
+
<tr><td>12dc1ea8e34b5a6</td><td>MSPaint 6.1</td></tr>
+
<tr><td>431a5b43435cc60b</td><td>Python (.pyc)</td></tr>
+
<tr><td>469e4a7982cea4d4</td><td>? (.job)</td></tr>
+
<tr><td>500b8c1d5302fc9c</td><td>(.pyw)</td></tr>
+
<tr><td>50620fe75ee0093</td><td>VMWare Player 3.1.4</td></tr>
+
<tr><td>65009083bfa6a094</td><td>(app launched via XPMode)</td></tr>
+
<tr><td>7e4dca80246863e3</td><td>Control Panel</td></tr>
+
<tr><td>83b03b46dcd30a0e</td><td>iTunes 10</td></tr>
+
<tr><td>b0459de4674aab56</td><td>(.vmcx)</td></tr>
+
</table>
+

Revision as of 02:14, 9 June 2014

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

LZ-based

LZNT1

Used in:

LZXPRESS

Used in:

LZXPRESS Huffman

Used in:

External Links

LZ1