01Location
- C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\*.automaticDestinations-ms
- C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\*.customDestinations-ms
- NTUSER.DAT: Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2 (ProgramsCacheSMP, ProgramsCacheTBP)
02Questions it answers
- Which files did a user open with a specific application, in which recency order?
- When was each item last updated in the DestList?
- Was an item pinned?
- On which host (NetBIOS name) and volume did the target reside?
03Format and versions
| Format | AutomaticDestinations: OLE Compound File with a DestList stream (32-byte header plus entries) and hexadecimal-named streams, each holding an LNK. CustomDestinations: header, categories (custom, known KDC_FREQUENT/KDC_RECENT, user tasks) and shell object entries with embedded LNK data, each category closed by footer 0xbabffbab. |
|---|---|
| Applies to | Windows 7 and later. DestList format version 1 is documented for Windows 7; versions 3 and 4 are reported for Windows 10. |
04Key fields
| Field | What it tells you |
|---|---|
| DestList header | Format version, number of entries and number of pinned entries. |
| Entry number | Links a DestList entry to the hexadecimal-named LNK stream. |
| Droid / birth droid identifiers | NTFS object identifiers of volume and file. |
| Hostname | NetBIOS name stored as a 16-byte ASCII field. |
| Pin status | -1 (0xffffffff) = unpinned; 0 or greater = pinned. |
| Path | UTF-16LE path of the item. |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| DestList entry last modification time | FILETIME (UTC) | Per-entry time kept by the jump list; distinct from the target times inside the LNK stream. |
| Embedded LNK header times | FILETIME (UTC) | Creation, access and write times of the link target. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Collect both destination directories for every profile.
- Parse the OLE compound file, map DestList entry numbers to streams and parse each embedded LNK.
- Build a timeline from DestList times and LNK target times; flag pinned entries.
- Attribute each file to its application using embedded paths and correlate with Prefetch and UserAssist.
07Interpretation pitfalls
- Several DestList fields (floating-point values, possible access count) are not understood; do not report them as facts.
- A DestList stream can be 0 bytes when the file is empty.
- CustomDestinations content is defined by the application (including user tasks) and does not necessarily represent files the user opened.
09Sources
- Jump lists format libyal / dtformats (J. Metz) · checked 2026-10-14
- Jump Lists ForensicArtifacts / artifacts-kb · checked 2026-10-14
- Windows Shortcut File (LNK) format libyal / liblnk (J. Metz) · checked 2026-10-14
- Windows artifact definitions (windows.yaml) ForensicArtifacts / artifacts · checked 2026-10-14