Jumplists
Also called jump lists, automaticDestinations-ms, customDestinations-ms, DestList.
- PLATFORM
- Windows
- CATEGORY
- File and Folder Access
- INDEX
- 6 of 36
- PROVES
- 4 findings
- CANNOT PROVE
- 5 limits
- QUESTIONS
- 3 answered
Per-application recent-file lists stored as compound files containing embedded LNK streams and an ordering list, recording which documents each program opened for a specific user.
Where it lives
%AppData%\Microsoft\Windows\Recent\AutomaticDestinations and \CustomDestinations; files named by an application identifier
Name the location in the preservation request rather than describing the artifact in general terms. A request that asks for the record by its path is one the responding party can act on and one a court can enforce; a request for “all forensic evidence of jumplists” is neither.
What it records
Windows maintains an automatic destinations file per application, named by an application identifier, holding a shortcut stream for each recent item plus a DestList stream that orders them and records supporting fields such as pinned status and, in some versions, an access count. Custom destinations files hold entries the application itself supplied. The embedded streams have the same structure as standalone shortcut files, so they carry target paths and, where populated, volume serial numbers.
What it proves — and what it cannot
These two panels carry equal weight, deliberately. The right-hand column is not a disclaimer: it is the specific, mechanical reason an inference fails, and it is the column opposing counsel will read back to a witness on cross-examination.
What it proves
FINDINGS THIS ARTIFACT WILL SUPPORT ON ITS OWN TERMS.
- Which documents a named application opened, tied to a user account — the application attribution that standalone shortcut files do not give you
- Target paths and, where the embedded LinkInfo is populated, the volume serial number and label of the media holding each file
- That a file was opened even where the standalone shortcut in the Recent folder has since been trimmed away
- Ordering of recent items, and pinned status, which distinguishes a document a user deliberately kept to hand from one merely opened once
What it cannot prove
INFERENCES IT WILL NOT CARRY, HOWEVER STRONGLY IT POINTS.
- That a file was copied rather than opened. The embedded streams have the same limits as any shortcut file
- A reliable count of accesses. DestList fields differ between versions, and a value present in one build may be absent or mean something different in another, so a count read out of a parser should be stated as version-dependent
- That a file was never opened. Lists are trimmed as they age and are cleared by the user, and an application that does not participate in the jump list mechanism generates nothing
- Which application identifier corresponds to which program, without a mapping. Identifiers are derived values, and an unmapped one is an unknown program rather than a suspicious one
- That the user chose the entry from the jump list. The entry records that the application opened the item, not the route by which it was opened
How the finding is attacked
An opinion built on this artifact meets these arguments. Each of them is answerable, and each of them is answered before the report is served rather than at a deposition.
- Challenging the application identifier mapping, which for less common software may rest on a community-compiled list rather than on anything authoritative
- Questioning a reported access count that the DestList version in question does not actually carry
- Arguing from an empty jump list that a document was not opened, when the list has simply aged out
- Noting that portable applications and command-line tools bypass the mechanism entirely, so the absence of an entry says nothing about them
What survives, and for how long
Jumplist files persist per user across reboots and outlive the documents they name, but each list is capped and trimmed as new items arrive, so older entries disappear on their own. Uninstalling the application does not necessarily remove its file, and clearing recent items does.
More matters are decided by what an artifact never kept than by what it says, which makes preservation timing the most consequential decision in the matter — and it is usually made months before anyone examines anything. The evidence preservation deadline calculator works from the date you first anticipated litigation.
Questions counsel ask
What do jumplists prove in a forensic examination?
Jumplists prove that a specific application, running under a specific user account, opened a named file at a recorded path. Because the entries embed the same structure as shortcut files, they can also carry the volume serial number of the media the file lived on. They are especially useful where the standalone shortcut in the user's Recent folder has already been trimmed away.
Do jumplists show how many times a file was opened?
Sometimes, and the answer depends on the version. The DestList stream carries supporting fields whose layout has changed across Windows releases, and a field a parser labels an access count in one version may be absent or mean something else in another. A report relying on such a count should say which version produced the file and which field was read.
Can jumplists be deleted?
Yes, easily. Clearing recent items removes them, the user can turn the feature off, and each list is trimmed automatically as newer entries arrive. That makes an absent entry weak evidence of absent access. Deliberate clearing may itself leave traces elsewhere — in the filesystem journals, or in the timing gap between an application's own records and its empty jump list.
Terms used on this page
Every term below is defined in the forensic glossary — what it is, why a case turns on it, and what happens when it is mishandled.
Related artifacts
No artifact carries a matter on its own. These are the records that corroborate, contradict, or supply the timeline this one cannot.
LNK Shortcut Files
Shortcut files Windows creates when a document is opened through the shell, retaining the target's full path, its size and timestamps, and often the volume serial number of the drive it lived on.
Shellbags
Registry entries preserving the name, position in the folder tree, and display settings of folders a user browsed in Explorer — including folders that no longer exist.
RecentDocs and the Open/Save MRU Keys
Per-user registry lists of recently opened documents and of the folders used in Open and Save dialogs, ordered by recency but carrying a timestamp only for the most recent entry.
Windows Timeline (ActivitiesCache)
A per-user database recording application usage and the documents opened in each application, with start and end times and, where account sync was on, activity from the user's other devices.
Whether the jumplistsevidence in your matter supports the opinion built on it is a question with a testable answer. Law & Forensics retains court-tested digital forensic expert witnesses and forensic neutrals.
A conflicts check and scoping call follow, normally within one business day. Please do not send privileged or case-sensitive material until conflicts have cleared.
- Can This Artifact Prove That?
Start from the claim rather than the artifact: which records bear on it, and what no combination of them establishes.
- Computer forensics
The examination this artifact is collected and analysed in, scoped to a matter and reported so it can be tested.
- The artifact index
All 36 entries, grouped by what they bear on and filterable by platform.
- Daubert and digital evidence
Why an opinion stated one level too strongly is an admissibility problem rather than a point for cross-examination.
Attorney advertising / expert services. This page describes forensic artifacts and the procedural rules that govern expert evidence in general terms. Artifact behaviour varies by operating-system version, build, and configuration, and every observation has to be verified against the system actually in front of you. Nothing here is legal advice, and it is not a substitute for checking the rules, standing orders, and case law of your own forum.