Lion Cipher Lab

Reconstruct which files a user opened — even ones since deleted — with Windows Jump Lists

• Digital Forensics & IR (DFIR)
• Intermediate
• ~50 min
• Free · no account required

Why it matters

Investigations turn again and again on a single question about a specific file: 'did this user open this document?', 'did they know this file existed?', 'was this the app that touched it?'. Execution artifacts like Prefetch tell you a program ran; shellbags tell you which folders a user browsed in Explorer; neither names the individual FILE an application opened. Jump lists do. A jump list is a small convenience feature — the 'recent' and 'pinned' menu that pops up when you right-click an app on the taskbar so you can jump straight back to the last thing you had open. To build that menu,…

What you'll learn

• explaining in plain words what a jump list is: the per-application 'recent / pinned' menu Windows shows when you right-click an app on the taskbar, and where it persists on disk
• knowing the two locations cold — %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms (one file per app, auto-recorded) and ...\CustomDestinations\*.customDestinations-ms (pinned / app-declared tasks)
• defining an AppID: the hex identifier that names each AutomaticDestinations file and maps it to a specific application, and resolving an unknown AppID from published lists
• manufacturing ground truth: creating a distinctively named test file and opening it with a common app (Notepad or WordPad) so that app writes a jump-list entry for your account
• parsing the jump list with Eric Zimmerman's JLECmd to CSV and reading the recovered file path, the MAC timestamps, the source volume serial number, the hostname and the DestList / MRU ordering
• proving the headline property: delete the test file, re-parse, and show the jump-list entry for the now-deleted file is STILL there — file-access evidence that outlives the file
• stating the honest limits out loud: a jump-list entry proves a file was opened THROUGH THAT APP's recent mechanism (so absence is not proof of no access), records the ACCOUNT not the human, and can be cleared
• judgment: how jump lists (which files an app opened) sit alongside shellbags (folder browsing), Prefetch (execution) and the USN journal / $MFT (file activity), and when you would reach for each

Steps in this lab

1. From zero: what a jump list is, and the two places it lives
2. Locate the jump-list stores on your own machine
3. Manufacture ground truth: create a distinctive file and open it in a common app
4. Get JLECmd and parse your AutomaticDestinations to CSV
5. Read the entry: the recovered path, timestamps, AppID and volume serial
6. The headline: delete the file, re-parse, and watch the entry survive
7. The honest negative: what a jump-list entry does NOT prove
8. Judgment: where jump lists fit, and when you reach for them

Open the full interactive lab →