What Are Jumplist Entries?
The Jump List function was first introduced within the Microsoft Windows 7 operating system and enables the user to view a list of the files most recently opened within each application pinned to the taskbar.
The user can view the Jump List entries for a particular application by right clicking on the program icon on the taskbar or the Start Menu. The list is the provided within a new window as provided below:
Jump List entries are user specific, meaning that different users will retain different Jump Lists, which makes it possible to potentially link specific file access to a specific user.
The Jump List also contains entries relevant to the program, therefore, if the application consists of an Internet browser, such as the Mozilla Firefox example above, then the Jump List entries will include websites visited.
The Jump List entries include various information including the time/date stamp of access, the Application ID (which can be used to identify which application was used to open the file) and the location of the file on the computer or device.
When a file is opened by the user, the entry is stored as an automatic Jump List within a file named automaticdestinations-ms.
Where are Jumplist Entries Stored?
The automaticdestinations-ms file is stored within a folder that is hidden from the normal user by default as it is part of the operation of the operating system, meaning that most users would not be aware of them or the content of them. This file is normally stored within the directory path Users\[User Name]\AppData\Microsoft\Windows\Recent\.
The Windows operating system also generates its own Jump List entries that are created when a user specifically creates a shortcut to a file or an application. These entries are also stored within the directory path Users\[User Name]\AppData\Microsoft\Windows\Recent\ and within a file named customdestinations-ms.
The entries within these files are not normally accessible to a user, however, they can be identified and the content interpreted using specialist software.
About Athena Forensics
For information on our digital forensic services or if you require any advice or assistance please contact a member of our team on 0330 123 4448 or via email on enquiries@athenaforensics.co.uk, further details are available on our contact us page.
Our client’s confidentiality is of the utmost importance. All correspondence is treated with discretion, from initial contact to the conclusion of any computer forensic investigation.
Our digital forensics experts are fully aware of the significance and importance of the information that they encounter and we have been accredited to ISO 9001 for 10 years.
Our forensic experts are all security cleared and we offer non-disclosure agreements if required. Our premises along with our security procedures have been inspected and approved by law enforcement agencies.
Athena Forensics do not disclose personal information to other companies or suppliers.
https://athenaforensics.co.uk/service/mobile-phone-forensic-experts/
https://athenaforensics.co.uk/service/computer-forensic-experts/
