Windows Jump Lists
| Format | Windows Jump Lists |
|---|---|
| Short name | Jump List |
| Category | execution |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Per-application lists of recently and frequently used items, keyed by an AppID, stored under %APPDATA%\Microsoft\Windows\Recent\ in AutomaticDestinations and CustomDestinations. AutomaticDestinations-ms files are OLE compound files holding one LNK stream per item and a DestList stream with access counts, last-access times, pin status and the host name; CustomDestinations-ms files hold categories of LNK records pinned or provided by the application, closed by a footer signature. They persist after the referenced files are gone.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset unknown | D0 CF 11 E0 A1 B1 1A E1 | ........ | OLE compound file signature (AutomaticDestinations-ms); the same bytes start every OLE compound file |
| offset unknown | AB FB BF BA | .... | CustomDestinations-ms footer signature 0xBABFFBAB at the end of the file |
Known extensions
.automaticdestinations-ms, .customdestinations-ms
References
- Jump lists format (libyal/dtformats) https://github.com/libyal/dtformats/blob/main/documentation/Jump%20lists%20format.asciidoc
- ForensicsWiki — Jump lists https://forensics.wiki/jump_lists/
Cite this entry
Crush Format Reference, “Windows Jump Lists”. https://kalink0.github.io/crush-forensics/formats/jump-list/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction