Jump Lists

From Forensics Wiki
Revision as of 09:10, 23 August 2011 by Jessek (Talk | contribs)

Jump to: navigation, search

Information icon.png

Please help to improve this article by expanding it.
Further information might be found on the discussion page.

Jump Lists are a feature found in Windows 7.

Jump Lists

Jump Lists are a new Windows 7 Taskbar feature that gives the user quick access to recently accessed application files and actions. Jump Lists come in two flavors, automatic (autodest, or *.automaticDestinations-ms) and custom (custdest, or *.customDestinations-ms) files. Autodest files are created by the operating system

Jump Lists are located in the user profile path, in the C:\Users\user\Recent folder. Autodest Jump Lists are located in the automaticDestinations subdirectory, and custdest files are located in the customDestinations subdirectory.


AutomaticDestinations

Path: C:\Users\user\Recent\AutomaticDestinations Files: *.automaticDestinations

Structure - The autodest files follow the MS-CFB compound file binary format specification.


CustomDestinations

Path: C:\Users\user\Recent\CustomDestinations Files: *.customDestinations

Structure


List of Jump List IDs 17d3eb086439f0d7 TrueCrypt 7.0a adecfb853d77462a MSWord 2007 c71ef2c372d322d7 PGP Desktop 10 cdf30b95c55fd785 MSExcel 2007 f5ac5390b9115fdb MSPowerPoint 2007

12dc1ea8e34b5a6 MSPaint 6.1 431a5b43435cc60b Python (.pyc) 469e4a7982cea4d4 ? (.job) 500b8c1d5302fc9c (.pyw) 50620fe75ee0093 VMWare Player 3.1.4 65009083bfa6a094 (app launched via XPMode) 7e4dca80246863e3 Control Panel (?) 83b03b46dcd30a0e iTunes 10 b0459de4674aab56 (.vmcx)Windows