Hello everyone.
In this video you will learn how to analyze jump test files.
Jump List.
Jump List is a feature available in Windows 7 and later versions that allows users to quickly access
previously accessed applications and files.
Windows creates two different types of jump lists Automatic destinations.
Custom destinations.
Automatic destinations are jump lists that are automatically created when a user opens a file or application.
Custom destinations are custom jump lists that are created when a user pins a file or application.
Automatic destinations.
This folder is located at C users.
The username you logged in Appdata roaming Microsoft Windows.
Recent automatic destination.
You can also access by typing percent data percent.
Microsoft Windows recent and automatic destinations.
In this folder you can see files like this.
Custom destinations.
This folder is also located at recent folder.
You can see the files inside Custom Destinations folder.
Forensics value of jump list.
Jump lists contain valuable information on user activity, including access files, programs, dates
and times.
They can be used to build a timeline of events for investigations into computer misuse or data theft.
Jump lists are useful in incident response and malware analysis, allowing investigators to identify
which files and programs were accessed by malware and its source.
However, jump lists can be easily manipulated or deleted by attackers and shouldn't be solely relied
upon for evidence.
Jump lists should be used in combination with other forensic techniques and tools to get a more complete
understanding of the user's activity on the computer.
Analyses of jump lists.
After obtaining the files, we can perform the analysis of jump list files using any of these tools.
Jelek MHD Jump List Explorer Windows Joplin's Faster or Jump List of Tools.
In this presentation we will discuss the usage of Jelek MD Jump List Explorer and Jump List Field Tools.
Analyses of jump lists.
Let's inspect this GitHub page before we move on with this slide, I want to show you the files inside
Custom Applications folder.
Let's copy the path for the Custom Destinations folder.
Then open a command prompt.
And CD.
Paste.
This.
You can see the format of the files present in here.
I also want to show you the automatic destinations folder.
Go back with CD dot dot.
Then type CD auto, then tap.
Answer.
Dear.
Same type of files are here, as you see.
Let's go back to our presentation.
We will inspect this GitHub page in a minute.
Look at the image on the right.
This is the screenshot of this GitHub link.
Each application has a unique ID.
Unfortunately, ID values of some applications are not available in this repository.
Let's click on the link.
You can see the unique IDs and matching applications.
For example, paint starts with zero, B3F and goes on.
When we look at the custom Destinations folder, there is an ID value that starts with the 35610.
As you see here, when we search the hexadecimal PS in the GitHub repo, we see that it coincides with
the application called Steam.
Now let's reinforce what we learned with tools.
Our first tool is Jump list View.
Jump List View is a tool created by NIR soft to start using it.
Simply double click the file.
After running jump this vortex, it scans the jump list on the only automatic destinations folder,
not the custom Destinations folder, then displays the information on this window.
You can select one or more items with control and then export them as a txt, csv, html or xml file.
You can also copy the selected items with Ctrl C and then paste the data into Excel or another spreadsheet
application.
I will show you how you demonstrate it.
I copied the items.
And now with Ctrl V, I will paste it.
To make this page good looking.
You can extend the column width manually.
While using jump disk tool.
We can get a lot of information about the jump list by double clicking on any jump list file.
Some of the information we can notice are.
File name full path and the application ID.
You can search for this application ID to learn which application created this file.
I don't recommend you to use this tool because it doesn't parse files inside Custom Destinations folder.
The next tool we will use is the Jumplist Explorer tool included in as tools.
Jump list Explorer helps a hacker or crime scene investigator to analyze jump list data.
Jump List Explorer provides a summary of jump list data and shows which files the user has recently
opened, which applications they have used and which folders they have accessed.
We can run the program by double clicking it.
Click file load jump lists.
We can move to the relevant directory and select all files inside here.
I will click Ctrl, a select all and open I will ignore them.
Click.
Okay.
These are the files from Custom Destinations folder.
I will go back again.
File load, jump list, go one folder back and I will write automatic destinations.
Control a.
And open.
Now we have loaded all the jump list files.
After loading the relevant files into the program, we can see the jump list type, the app ID and its
description.
When you click one of the applications.
For example, let's click on Microsoft Visual Studio Code.
It will update the section below.
You can see the list of jump disk files related to the application you specified.
You can click file export link files to export the files you listed.
Of course, if they are not deleted, I click desktop.
Jump tools make new folder.
Export it.
And.
Okay.
When I come back to this directory.
You can see the files.
I want to click on the first one.
And here is the file we just exported.
Our last tool is.
We can open a command probe in this directory.
Type garlic and tap.
After running it with no option, the information about the tool appears in order to parse the jump
list folders, you need to write a comment like this.
Click tap t to specify a directory.
See users.
Username.
App data.
Roaming.
Microsoft.
Windows and recent.
You need to stop in here.
This will find both automatic destinations and custom destinations folder in that directory.
Later you need to type dash dash, csv and the output directory.
First you need to click here and then copy the path here.
Paste it.
Then enter.
After the command is run, it performs the pass operation and presents us two CSV files.
Let's check our folder here.
There are two Excel files.
One is automatic destinations and the second one is custom destinations.
I strongly advise you to further explore these tools yourself.
This video is over.
See you on the next video.