Jump lists in depth (includes changes from Windows 10), by Eric Zimmerman, Feb 2016. Jump lists format, by the libyal project, July 2014. Forensic Analysis of Windows 7 Jump Lists, by Rob Lyness, October 2012. Jump List Analysis, by Harlan Carvey, December 28, 2011. Jump List Analysis, pt II, by Harlan Carvey, August 24, 2011. Jump List Analysis, by Harlan Carvey, August 17, 2011. Forensic Examination of Windows 7 Jump Lists, by Troy Larson, June 6, 2011. The Forensic Value of the Windows 7 Jump List, by Alexander G Barnett, April 18, 2011. Jump Lists in Windows 7 and Possible Forensic Implementations, by Mike Ahrendt, April 3, 2011. Windows 7 Goodies in C++: Jump Lists, by Michael Dunn, May 19, 2009. Path: C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinationsĬustomDestinations Jump List files reportedly follow a structure of sequential MS-SHLLINK binary format segments. The CustomDestinations Jump List files are located in the user profile path: Path string size, the number of characters (UTF-16 words) of the path string Last modification time, contains a FILETIME structure Stream number corresponds to the numbered stream within the jump list NetBIOS name of the system padded with zeros to 16 bytes The first 114 bytes of the structure contains the following information at the corresponding offsets: Each of these structures is 114 bytes in size, followed by a variable length Unicode string. This stream consists of a 32-byte header, followed by the various structures that correspond to each of the individual numbered streams. The "DestList" stream acts as a most recently/frequently used (MRU/MFU) list. One could extract all the streams and analyze them individually with a LNK parser. The AutomaticDestinations Jump List files are OLE Compound Files containing multiple streams of which:Įach of the hexadecimal numbered streams contains data similar of that of a Windows Shortcut (LNK). Path: C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations 
The AutomaticDestinations Jump List files are located in the user profile path:
Explorer Start ProgramsCache Registry values.custom (custdest, or *.customDestinations-ms) files.
automatic (autodest, or *.automaticDestinations-ms) files. Jump Lists are a new Windows 7 Taskbar feature that gives the user quick access to recently accessed application files and actions.
0 kommentar(er)
