jump lists remember more than the user does

the taskbar has a better memory than you do

right click any pinned app on your taskbar and you get that little "recent" list. most people glance at it, maybe click something, and move on. what almost nobody thinks about is that windows isn't just holding that list in ram for your convenience, it's writing it to disk, per application, with timestamps, and it keeps that data around long after you've deleted the file it's pointing to. this is jump list data, and if you're trying to understand what happened on a machine (yours or one you're responsible for), it's one of the richest sources you probably haven't checked.

what jump lists actually are

jump lists are stored as two flavors of files under each user's appdata folder: AutomaticDestinations and CustomDestinations. automatic ones are built by windows itself every time you open a file in an app. custom ones are things the app itself pins, like "recent projects" in office. the automatic destinations files are the interesting ones for tracing activity because they're generated passively, the user isn't curating them, windows just logs it.

each jump list file is tied to a specific application via an AppID hash, and inside it windows embeds shell items that describe exactly what was opened: the file path, the volume it lived on, and multiple timestamps for creation, access, and modification. if that file lived on a usb stick or a network share, that gets recorded too, including volume serial numbers in a lot of cases. delete the file, empty the recycle bin, doesn't matter, the jump list entry can still be sitting there.

breaking down the command

JLECmd.exe -d "C:\Users\<u>\...\AutomaticDestinations" --csv .

this is Eric Zimmerman's JLECmd, a free tool built specifically to parse jump list files into something readable. here's what each piece is doing:

JLECmd.exe is the parser itself, it knows the binary structure of jump list files so you don't have to reverse engineer it by hand.

-d "path" tells it which directory to scan. that path is the real location on disk: C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations. swap in the actual username you're checking.

--csv . tells it to dump the parsed output as a csv file in the current directory, so you can open it in excel, timeline software, or grep through it if that's more your speed.

run it and you get a spreadsheet of every app, every file it touched, source volume, and a stack of timestamps. it's basically a receipt trail for "who opened what, from where, and when."

why this matters if you're defending, not attacking

the offensive angle here is obvious and boring: if you're an attacker who used explorer or an app to open a file off a network share or a usb stick, you left a fingerprint whether you meant to or not. the defensive angle is the actual point of this post. if you're doing incident response on your own environment, or you're just trying to figure out "did someone plug something in and open files off it while i was away from my desk," jump lists are how you check without guessing.

they're also useful in totally non-adversarial situations. lost track of which spreadsheet you were editing last tuesday before the crash? jump lists know. suspicious a shared family computer had a usb drive plugged in that shouldn't have been? jump lists will show file access tied to that volume, timestamped, even if the drive is long gone and the files were deleted off the main disk.

how to check your own exposure

the fact that this data persists is exactly why you should know it exists, mainly so you're not caught off guard by what your own machine is holding onto.

run JLECmd against your own AutomaticDestinations folder periodically if you're auditing a shared or public-facing machine. look for AppIDs tied to software you don't recognize, or file paths pointing at volumes you don't remember connecting.

if you're hardening a machine that handles sensitive files, know that "deleting the file" is not the same as "removing the evidence it existed." clearing jump lists specifically means clearing the AutomaticDestinations and CustomDestinations folders, and even then, that's a visible action in itself if someone's looking at timeline gaps.

for genuinely sensitive workflows, the better fix isn't trying to scrub artifacts after the fact, it's not opening sensitive files directly from removable media or shares on a general-use machine in the first place. use a dedicated, disposable environment for that kind of work.

the takeaway

jump lists exist because windows is trying to be helpful, showing you your recent files fast. the tradeoff is that "helpful" and "persistent record of everything you touched" are the same feature. that's great news when you're investigating your own systems and terrible news if you assumed deleting a file made it disappear. know what your machine remembers, because it remembers more than you do.