Windows 7 Jump Lists provide a history of items opened by applications to allow quick access through a taskbar menu. Jump Lists are stored in automaticDestinations-ms and customDestinations-ms files, recording hundreds of recent items in a structured storage format. These files can be investigated to determine a user's application activity, find deleted files, or show intent.

1. Forensic Examination of
Windows 7 Jump Lists
Troy Larson
Principal Forensics Program Manager
TWC Network Security Investigations
NSINV-R3– Research|Readiness|Response

2. Windows 7 Jump Lists
• . . . users should be able to “jump” directly to those things they want to work with and start
working with them in a single mouse click. To provide this functionality, Windows 7 Taskbar
introduces the concept of “Jump Lists.”
• . . . think of Jump Lists as your own mini Start Menu for your application.
http://blogs.msdn.com/b/yochay/archive/2009/01/06/windows-7-taskbar-part-1-the-basics.aspx

3. Windows 7 Jump Lists
Ramifications for forensic investigations:
– History of items opened or modified by a particular application.
• Similar to other Most Recently Used (MRU) or Most Frequently Used (MFU) artifacts.
• But not based on shortcut (.LNK) files or registry stores.
– Distinctive features:
• Lists of MRU or MFU items organized by application.
• List can retain several hundred items.
• Items may remain on a list after their target is deleted from the volume.
• Although items can be deleted from the lists, deletions can be detected.
• Only a few items shown for any list; list can have hundreds more items than are shown.

4. Windows 7 Jump Lists
Jump Lists are likely to be worth investigating in detail, when:
– A user’s historic activity is at issue.
• What files, SharePoint sites, or Web pages have been opened or accessed.
– There is a concern that data files have been deleted or moved.
– To show knowledge or intent.
– Search term hits occur within Jump List files.

5. Windows 7 Jump Lists
Destinations
(“nouns”)
Tasks
(“verbs”)
Known categories
Custom categories
User Tasks
Taskbar Tasks
Pinned category

6. Windows 7 Jump Lists
Destinations
(“nouns”)
Tasks
(“verbs”)
Known categories
Custom categories
User Tasks
Taskbar Tasks
Pinned category
User tasks and destinations are forms of links.

7. Windows 7 Jump Lists
Jump List content is derived
from two data files.
– “Destination” files.
• [AppID]automaticDestinations-ms
• [AppID]customDestinations-ms

8. Windows 7 Jump Lists
• Automatic Destinations:
– List of “destinations.”
– Automatically populated by the system.
– Based on calls to SHAddToRecentDocs.
• Collects information about data file usage.
• Records information in the Recent Items folder, and the “using” application’s automatic destination
file.
• Sorted by recency (MRU) or frequency (MFU).
C:Users[Profile]AppDataRoamingMicrosoftWindowsRecentAutomaticDestinations
• Custom Destinations:
– List of “destinations.”
– Content maintained by the application.
• Custom categories.
• Tasks specific to the application.
– Specified by the application using the ICustomDestinationList API.
C:Users[Profile]AppDataRoamingMicrosoftWindowsRecentCustomDestinations

9. Windows 7 Jump Lists
Windows 7: Recent folder.
– AutomaticDestinations folder.
– CustomDestinations folder.
– Shortcut (.lnk) files.

10. Windows 7 Jump Lists

11. Windows 7 Jump Lists

12. Windows 7 Jump Lists
Note:
– More automatic destination files.
– Matched pairs share the same AppID
– Custom destinations have temporary files.
And so on.

13. Windows 7 Jump Lists
• AppID is based on the process name or can be
specified by the application.
– Different command arguments for the same
application may result in different AppIDs.
• Applications can have more than one AppID.
– The same process (with same command argument)
should have the same AppID across systems.
• AppID can be used to identify the application owning a
destination file.
• Permits the investigator to selectively investigate destination
files.

14. Windows 7 Jump Lists
AppID Application
1b4dd67f29cb1962 Explorer (task bar folder icon)
1bc392b8e104a00e Remote Desktop
23646679aaccfae0 Adobe Reader 9 x64
271e609288e1210a Access 2010 x86
28c8b86deab549a1 Internet Explorer x86
290532160612e071 WinRar x64
2b53c4ddf69195fc Zune x64
3094cdb43bf5e9c2 OneNote 2010 x86
5da8f997fd5f9428 Internet Explorer x64
74d7f43c1561fc1e Windows Media Player
9839aec31243a928 Excel 2010 x86
9b9cdc69c1c24e2b Notepad x64
9c7cc110ff56d1bd PowerPoint 2010 x86
a7bd71699cd38d1c Word 2010 x86
b8c29862d9f95832 InfoPath 2010 x86
b91050d8b077a4e8 Windows Media Center x64
be71009ff8bb02a2 Outlook x86
d64d36b238c843a3 InfoPath 2010 x86
e36bfc8972e5ab1d XPS Viewer
Some AppIDs for common applications

15. Windows 7 Jump Lists
Anatomy of the custom destination file.
– One or more streams in the shell link file format.
http://msdn.microsoft.com/en-us/library/dd871305(v=prot.10).aspx

16. Windows 7 Jump Lists
Anatomy of the automatic destination file.
– Structured Storage format.
http://msdn.microsoft.com/en-us/library/aa380369(v=VS.85).aspx
http://msdn.microsoft.com/en-us/library/dd942138(v=prot.13).aspx
– Containing one or more streams in the shell link file format.

17. Windows 7 Jump Lists
Anatomy of the automatic destination file in a structured storage viewer: OffVis.

18. Windows 7 Jump Lists
Anatomy of the
automatic
destination file in a
structured storage
viewer: SS.exe.
• Streams.
• Higher
number=more
recent or more
frequent.

19. Windows 7 Jump Lists
Anatomy of the
automatic
destination file in a
structured storage
viewer:
• DestList.
• Order of
presentation on
the jump list.

20. Windows 7 Jump Lists
Analysis of Custom Destination Files
• Review the series of shell link
items in a hex editor.
Or
• Carve and parse:
– Using a hex editor, carve out each
shell link item, saving each to a
separate file.
– Use a link file parser to review the
extracted shell link streams.
– Some streams may not be complete
shell items, e.g. paths.
Analysis of Automatic Destination Files
• Parse the file with a structured
storage viewer and review the 1)
stream enumeration and 2) shell
link streams.
Or
• Carve and parse:
– Using structured storage parser/viewer,
extract each stream to a separate file.
– Review the DestLisk with a hex editor.
– Use a link file parser to review the
extracted shell link streams.

21. Windows 7 Jump Lists
Carve and parse: Custom destination file.
. . .
Carve shell link item
and copy or export to
file.

22. Windows 7 Jump Lists
Carve and
parse: Custom
destination file.
010 Editor with
LNK template.

23. Windows 7 Jump Lists
Carve and parse: Custom
destination file.
– File properties of the
extracted shell link
item.

24. Windows 7 Jump Lists
Carve and parse: Automatic Destination Files.
MiTec’s Structured Storage Viewer.
http://www.mitec.cz/ssv.html

25. Windows 7 Jump Lists
Carve and parse: Automatic Destination Files.
MiTec’s Windows File Analyzer.
http://www.mitec.cz/wfa.html

26. Windows 7 Jump Lists
Items can be removed from a list. Removed items will leave gaps in
the number sequence of the streams in the automatic destination file.
Stream list from
MiTec’s Structured
Storage Viewer.

27. Windows 7 Jump Lists
OffVis:
– Defragment the file
– Reparse to identify deleted items.
21

28. Windows 7 Jump Lists
OffVis:
= deleted items.

29. Windows 7 Jump Lists
Stream of a list item.

30. Windows 7 Jump Lists
Stream of a removed item.

31. Windows 7 Jump Lists
Quick review-automatic and custom destination files.
– Jumplist File Extract.
– http://www.regdat.com/

32. Windows 7 Jump Lists