JumpList Automatic Files
Overview
Section titled “Overview”Evidence: JumpList Automatic Files
Description: Collect JumpList Automatic Files
Category: System
Platform: windows
Short Name: jmplautocol
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): Yes
Background
Section titled “Background”AutomaticDestinations JumpLists track recent documents per application. This data is essential for reconstructing file usage and application activity.
Data Collected
Section titled “Data Collected”This collector gathers structured data about jumplist automatic files.
Collection Method
Section titled “Collection Method”This collector walks user JumpList directories, copies .automaticDestinations-ms files, and records file timestamps into jumplist_automatic_collected_files.
Forensic Value
Section titled “Forensic Value”This evidence is crucial for forensic investigations as JumpLists reveal recently used files even after deletion.