One of the most prominent GUI feature in Windows 7 is the new Taskbar and the
integrated Jump List; designed as an interactive combination of quick launch shortcuts with taskbar buttons, plus application specific common tasks. It allows user to have access to most frequent tasks such as ‘Play next song’ in Windows Media Player, directly from the taskbar. Additionally user can also choose the most recent or frequent files handled by this application. This part of functionality is significant to forensics, as it could provide new sources of evidence.
Since the Windows 7 Beta was released, this feature was talked about, also in forensics community. Harlan Carvey said: “from a forensic perspective, this "Jump List" thing is just going to be a gold mine for an analyst, much like RecentDocs and UserAssist keys have been since Windows 2000” (CARVEY, Harlan, 2009).
Microsoft encourages developers to make use of these new functionalities in their software, to further integrate application to the Operating System. The company provides them with detailed documentation, video tutorials and walkthroughs on how to implement the new taskbar functionality. However, as with other features, little is known about how the features work or where data is being stored. After an extended research, on Microsoft Developers Network the following was found:
In addition to updating its list of recent documents, the Shell adds a shortcut to the user's Recent directory. The Windows 7 Taskbar uses that list and Recent directory to populate the list of recent items in the Jump Lists. (YOCHAYK, 2009)
Therefore, it is clear that recent files displayed in Jump List are the same as in the
<username>\Recentdirectory. This data is simply duplicated, only presented in a more approachable manner to the user.
Anytime you double click on a file type with a registered handler [application that supports the file type], before Windows launches your application it automatically calls SHAddToRecentDocs on your application's behalf. This inserts the item in the Windows Recent list and eventually into the Jump List Recent Category. (YOCHAYK, 2009)
The above fragment explains mechanism in which items are added to the Windows Recent list and the Recent folder, what forms a basis for the Jump List recent items.
In addition to the recent and frequent lists, developers can add their own customized item list. This is the part that could make investigation of the Jump List worthwhile. Unless an application uses customized item list, by default a Jump List would only contain items from
First Look at the Windows 7 Forensics
the Recent directory. In such scenario, investigator can much easier navigate into the directory to view links to recently accessed documents or location rather than trying to find data artefacts in the system. However user can also ‘pin’ an item, in order to
permanently keep it in the Jump List, which would be recorded in jump list data store but could be removed from the Recent directory.
The Jump List feature is enabled by default, however user can disable it from the
Panel > Taskbar and Start Menu
The first option records recent applications displayed in a start menu and the second checkbox switches on or off the Jump List functionality. This is also the only way to clear the list, user has to un-tick the box and click apply, then if needed the function can be re enabled but with the emptied list. The pinned items remain in the list until being removed by a user. Further customization can be done by clicking the Customize button, where user can, among other things, add the recent items to the start menu like in previous versions of Windows.
Figure 8. Start Menu properties window, allows user to disable the Jump List and customize contents of the start
From the forensics standpoint this feature can indeed become a valuable source of information, especially if suspect deleted contents of the
very recently it has not been known where the recent item data is stored. Although some suggested that it might be in registry stored on a per
evidence that it was not the case
Microsoft has frustrated some of beta testers. Later, one of the users from the forum suggested that the path to the files is:
C:\Users\<Username>\AppData\Roaming
this is in fact the correct path as it was unofficially confirmed by Microsoft in their presentation for Law Enforcement only
2009).
First Look at the Windows 7 Forensics Piotrek Smulikowski
the Recent directory. In such scenario, investigator can much easier navigate into the to view links to recently accessed documents or location rather than trying to find data artefacts in the system. However user can also ‘pin’ an item, in order to
permanently keep it in the Jump List, which would be recorded in jump list data store but uld be removed from the Recent directory.
The Jump List feature is enabled by default, however user can disable it from the
Panel > Taskbar and Start Menuin the second tab called Start Menu as seen on
The first option records recent applications displayed in a start menu and the second checkbox switches on or off the Jump List functionality. This is also the only way to clear
tick the box and click apply, then if needed the function can be re enabled but with the emptied list. The pinned items remain in the list until being removed by a user. Further customization can be done by clicking the Customize button, where user
among other things, add the recent items to the start menu like in previous versions of
. Start Menu properties window, allows user to disable the Jump List and customize contents of the start menu.
rensics standpoint this feature can indeed become a valuable source of information, especially if suspect deleted contents of the <username>\Recentfolder. Until very recently it has not been known where the recent item data is stored. Although some
ted that it might be in registry stored on a per-application basis, however, there was evidence that it was not the case (JODO3333, 2009). This lack of information from
Microsoft has frustrated some of beta testers. Later, one of the users from the forum suggested that the path to the files is:
Roaming\Microsoft\Windows\ Recent\automaticDestinations
act the correct path as it was unofficially confirmed by Microsoft in their
presentation for Law Enforcement only (MICROSOFT LAW ENFORCEMENT TECH TEAM, Piotrek Smulikowski
the Recent directory. In such scenario, investigator can much easier navigate into the to view links to recently accessed documents or location rather than trying to find data artefacts in the system. However user can also ‘pin’ an item, in order to
permanently keep it in the Jump List, which would be recorded in jump list data store but
The Jump List feature is enabled by default, however user can disable it from the Control
in the second tab called Start Menu as seen on Figure 8.
The first option records recent applications displayed in a start menu and the second checkbox switches on or off the Jump List functionality. This is also the only way to clear
tick the box and click apply, then if needed the function can be re-enabled but with the emptied list. The pinned items remain in the list until being removed by a user. Further customization can be done by clicking the Customize button, where user
among other things, add the recent items to the start menu like in previous versions of
. Start Menu properties window, allows user to disable the Jump List and customize contents of the start
rensics standpoint this feature can indeed become a valuable source of folder. Until very recently it has not been known where the recent item data is stored. Although some
application basis, however, there was . This lack of information from
Microsoft has frustrated some of beta testers. Later, one of the users from the forum
utomaticDestinations,
act the correct path as it was unofficially confirmed by Microsoft in their
(MICROSOFT LAW ENFORCEMENT TECH TEAM,
First Look at the Windows 7 Forensics Piotrek Smulikowski
Automatic Destination folder contains files responsible for the recent items on a Jump List.
Every program that has items recorded in the list has its file stored in this directory. Files names are in a format XXXXXXXXXXXXXXXX.automaticDesitnations-ms, where name is about 16 digit long and the extension is ‘automaticDestination-ms’. When the Jump List feature is disabled, the contents of the folder are cleared. User can still perform tasks available for the application, however, no recent files are stored. Files are binary and it is not easy to
understand the contents, especially as some of them can get large and complex. The default number of the recent items stored is 10 but it can be changed by a user. The order in which items are added to the list remains unclear. All files paths that are stored in the file, are part of application’s Jump List. The Figure 9 shows sample content of the Automatic Destination folder and clear text stored in the Jump List file, this particular file belongs to the Microsoft Paint application. The contents of the binary file seem chaotic however, forensic examiner should be able to determine the file paths recorded in the recent item list.
Figure 9. Contents of the Jump List recent items file viewed in hex editor. Path to recent 'cos.png' file is highlighted in grey. This particular file, stores recent items list for Microsoft Paint.
Numerous tests on different machines revealed that a naming pattern seems to appear: the file name represents specific application which is fixed. As an example the following file
1b4dd67f29cb1962.automaticDesitnations-msis a store file for Windows Explorer.
Analogically some of the other common applications were identified as seen in the Table 4:
File name Application
1b4dd67f29cb1962. Windows Explorer
918e0ecb43d17e23. Notepad
74d7f43c1561dc1e. Windows Media Player
99189dc15d887da6. Windows Disc Image Burner
First Look at the Windows 7 Forensics Piotrek Smulikowski
adecfb853d77462a. Microsoft Word 2007
b3f13480c2785ae. Paint
5c450709f7ae4396. Firefox
9fda41b86ddcf1db. VLC player
23646679aaccfae0. Acrobat Reader 8.0
Table 4. File names and their respective application that store Jump List data
In order to identify the pattern the files in the AutomaticDestination folder were viewed in a Hex editor and contents were compared against recent items in the Jump List. Once type of a program was known it was cross checked with files on different computers. This kind of naming model was present on the 3 tested machines. However, because no
documentation is available, it has not been possible to verify if the pattern is true for every PC or installation.
When the Jump List feature is disabled, the contents of the folder are cleared. User can still perform tasks available for the application, however, no recent files are stored. Additionally it was noted that the Windows Explorer’s recent items list behaves slightly differently than the rest. If user navigates to the e.g. readme.txt file and opens it, the handling application’s Jump List is updated but so is the Windows Explorer’s list. However if a user navigates only to the folder but does not open any files, the Jump List does not record the path. This is presumably because, no file was open no target was selected and destination path was not confirmed.
Microsoft has also identified another folder with files responsible for the Jump List(MICROSOFT LAW ENFORCEMENT TECH TEAM, 2009):
C:\Users\<Username>\AppData\Roaming\Microsoft\Windows\Recent\customDestinations
It stores files in similar format e.g. 74d7f43c1561dc1e.customDestinations. It is unclear what exactly these files contain but it is believed that they allow applications to have their own, custom ‘destinations’ or tasks. When examined files contain various tasks for instance
‘Start InPrivate Browsing’ just like Internet’s Explorer 8 task.
This theory goes in line with the Jump Lists (in development stage known as Destination Lists) description given by Microsoft:
The Destination List is automatically populated based on frequency and recency of use for file-based applications. Additionally, an application can define custom destinations, enabling it to monitor its own destination usage and their semantics. Applications can also define Tasks (actions within the application that users will find convenient to access directly, for example, composing an e-mail) to appear in their menus. (OIAGA, Marius, 2009)
First Look at the Windows 7 Forensics Piotrek Smulikowski
According to this extract Automatic Destinations folder is designed to store frequent and recent items only, whereas the Custom Destinations folder holds applications specific destinations or tasks.
As a result, forensic investigator should only be concerned with the AutomaticDestinations
directory as it records the user activity. As previously mentioned this can be successful mainly if the user attempts to manually delete his Recent folder contents. In this case he would only delete links stored in that directory, with the Destinations folders remaining due to being hidden and protected by the OS.
First Look at the Windows 7 Forensics Piotrek Smulikowski