> For the complete documentation index, see [llms.txt](https://mahmoud-shaker.gitbook.io/dfir-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://mahmoud-shaker.gitbook.io/dfir-notes/jump-list-forensics.md).

# Jump List Forensics

jump Lists are Windows artifacts that track recently or frequently accessed files and applications

### **Two types:**

1. **Automatic**: Generated by Windows for supported apps (e.g., Notepad, MS Word).
2. **Custom**: Created by applications to define recent/frequent items.

### **Common locations:**

* **Automatic**: `%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\`
* **Custom**: `%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\`

### **Forensic Significance**

* Provide a timeline of file and application usage.
* Contain metadata such as:
  * Application name.
  * File access timestamps.
  * File paths (local and remote)

### **Forensic Value of Jump Lists**

* **Check Tasks:** Details about tasks performed by the application.
* **Links to Recent Files:** Access to files that were recently opened by the application.
* **Frequently Used Files:** Insight into files that are accessed frequently.
* **Links to Pinned Files:** Information about files that the user has pinned for easy access.
* **Help in Building a Timeline:** Data that helps reconstruct the sequence of user actions and activities.

### **Tools for Investigation**

* **JumpList Explorer**: Specialized tool for parsing Jump Lists.
* **Eric Zimmerman's JLECmd**: Command-line tool to parse both automatic and custom Jump Lists.
* **Autopsy or FTK Imager**: For acquiring and viewing Jump Lists

Here I used **JumpList Explorer** and look what i got 

<figure><img src="https://2439395933-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2Fzy2g7VTMKRVpTMzwGrHF%2Fuploads%2FAXn9ENB8gaJ8Wg43zzR4%2Fjump%20list.webp?alt=media&amp;token=7e294e80-78c2-4b15-a57a-68e6fa74a42c" alt=""><figcaption></figcaption></figure>