Knowledgebase:
How to View the Jump List Files
Posted by on 01 July 2019 05:23 AM

Electronic Evidence Examiner allows you to detect the jump list files, which are OLE Compound Files, in the filesystem evidence and view them in the Hex and Text viewers.

The jump list files contain information about the applications that are pinned on a user's taskbar, timestamps, as well as the paths to the items (documents, webpages, images, etc.) recently accessed by a program pinned on a user's taskbar.

To view the jump list files content:

1. Add filesystem evidence to a new or existing case (for more information on adding different types of evidence, please see the corresponding How to Investigate… topic).

2. In the Case Content pane (to the left), navigate to the folder containing the jump list files; or use the Advanced Search option to find the jump list files by their extension (.customDestinations-ms or .automaticDestinations-ms).

NOTE: The default location of the jump list files is the following: C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations; C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations.

3. Select the required jump list file.

4. In the File Viewers group, select the Hex View tab or the Text View tab to view the jump list file in the corresponding format

(0 vote(s))
Helpful
Not helpful

Comments (0)