Jumplist / RecentFiles

Introduced in Windows 7, Jumplists are linked to a taskbar user experience-enhancing feature that allows users to "jump" to files, folders or others elements by right clicking on open applications in the Windows taskbar. The Windows Explorer's Quick Access feature also stores entries in Jumplists

There are two types of Jumplists:

• automatic entries for recently accessed items, stored in *.automaticDestinations-ms files.

• custom entries in *.customDestinations-ms files for items manually "pinned" elements (by users or the applications themselves) to the Windows taskbar or an application's Jumplist.

Provide quick access to recently accessed applications, files and folders. Stored as DB files. Variants of Jump Lists:

• the target file's absolute path, size and attributes (hidden, read-only, etc.).

• the target file Modified, Access, and Created (MAC) timestamps, updated whenever the file is "jumped" to.

• the number of times the target file was "jumped" to.

Automatic-Destinations, is created when the user opens files/folder, or access some utility or tools:

%USERNAME%\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations

Custom-Destinations, is created when the user pins an application via taskbar:

%USERNAME%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations

Parsing:

Eric Zimmerman's JumpListExplorer.exe and JLECmd.exe tools

# Parses the specified JumpLists file.
JLECmd.exe [-q --csv <CSV_DIRECTORY_OUTPUT>] -f <JUMPLIST_FILE>

# Recursively retrieves and parses the JumpLists files in the specified directory.
JLECmd.exe [-q --csv <CSV_DIRECTORY_OUTPUT>] -d <C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Recent\ | C:\ | DIRECTORY>