Understanding and Demonstrating working of Jumplists

 

To understand and demonstrate working of jumplists from data forensic perspective by using jumplists view tool.

Jump Lists basically created for providing the quick access to the recently opened documents for respective application. Which is first introduced in the Windows 7.

For data forensic perspective, By using Jumplists forensic investigator can analyse the suspect's activity like tracking recently opened application, when the file or application opened or closed, etc. Jumplists provide the Most Recently Used and Most Frequently Used list for respective application which is helpful for data forensic.

There are two sets created for storing jumplists in windows:

AutomaticDestinations

This is automatically generated by Operating System when any file or application opened. The files stored in it, has .automaticDesinations-ms extension. To access this file we need to go through the following path.

C:\Users\XYZ\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations

CustomDestinations

This is used for storing the jumplists which is created when the user pins a file or application. The files stored in it, has .customDesinations-ms extension. To access this file we need to go through the following path.

C:\Users\XYZ\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations

We can get useful information from these files by using following tools:

• JLECmd (Jump List Parser) by Eric Zimmerman
• JumpList Explorer (GUI based Jump List viewer) by Eric Zimmerman
• JumpListsView by NirSoft

JumpListsView is a basic tool that displays the information stored by the Jump Lists files. 

We can also be save these information in file or make html report for data forensics purpose.