Jumplist-Browser
Automatic/Custom Destinations & LNK (MS-SHLLINK) Browser
Project maintained by kacos2000
Hosted on GitHub Pages — Theme by mattgraham
Jumplist-Browser
Automatic/Custom Destinations & LNK (ShellLNK) Browser
==> Latest version <==
Dependencies:
- Operating system: Microsoft Windows 10+ 64 Bit
- .NET Framework 4.8
- Powershell Version: 5.1
_______________
Supports:
- Link: (.lnk) shortcut files
- Frequent Places Lists: ‘.customDestinations-ms’ and ‘.automaticDestinations-ms’ files
- Raw image files: ‘.001’, ‘.raw’,’.dd’, ‘.img’, ‘.ima’ via the ‘Open File’ dialog - (carves and shows .lnk files and their offsets)
- Current User (HKCU) keys which contain Shellink items:
- ‘Software\Microsoft\Windows\Shell\BagMRU’
- ‘Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU’
- ‘Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs’
- ‘Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32':
- ‘OpenSavePidlMRU’
- ‘LastVisitedPidlMRU’
- ‘LastVisitedPidlMRULegacy’
- ‘Software\Microsoft\Windows\CurrentVersion\Explorer\TWinUI\FilePicker\LastVisitedPidlMRU’
- ‘Software\Microsoft\Windows\CurrentVersion\Explorer\Streams’
- ‘Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU’
- ‘Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery’
- ‘Software\Microsoft\Windows\CurrentVersion\Search’
- ‘JumplistData’ &
- ‘RecentApps’
- ‘Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband’:
- Favorites’
- ‘FavoritesResolve’
- ‘Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2’:
- ‘Favorites’
- ‘FavoritesResolve’
- ‘ProgramsCache’
- ‘ProgramsCacheSMP’
- ‘ProgramsCacheTBP’
- ‘Software\Microsoft\Windows\CurrentVersion\Lock Screen’ (Lock screen background image(s))
Features:
Sample screenshots:








[TIP]:
In ‘automaticDestinations-ms’ files, with the exception of Windows Control Panel, Windows Explorer and Quick Access,
entries usually include a ‘Hint’ on which Application they are related to.
These ‘hints’ are seen in the last IDlist entry (type [32] (File)):
either indirectly:
MPC-HC (Media Player Classic - Home Cinema):

MS Excel:

Edge Browser:

(the “AppXd4nrz8ff68srnhf9t5a8sbjyar1cr723” type entries can be looked up in:
‘HKLM::Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs’)
or Directly:
Windows Wordpad:

Modern CSV:

Maël Hörz’s HxD Hex Editor

References:
- Note: Uses the following Libraries: