Jump Lists

Location

Description

Application-specific Jump List files (.automaticDestinations-ms) recording recently and frequently accessed files per application, with timestamps and full file paths including network shares.

Forensic Value

Jump Lists persist evidence of file access even after the files themselves are deleted. They record full UNC paths for network shares, directly supporting data exfiltration investigations by showing which remote file shares a user accessed and when. The embedded LNK metadata within each entry provides additional MAC timestamps and volume serial numbers.

Tools Required