Skip to content

Automatic/Custom Destinations & LNK (MS-SHLLINK) Browser

License

Notifications You must be signed in to change notification settings

kacos2000/Jumplist-Browser

Repository files navigation

Jumplist-Browser

Automatic/Custom Destinations & LNK (ShellLNK) Browser

==> Latest version <==


Dependencies:


Supports:

  • Link: (.lnk) shortcut files
  • Frequent Places Lists: '.customDestinations-ms' and '.automaticDestinations-ms' files
  • Raw image files: '.001', '.raw','.dd', '.img', '.ima' via the 'Open File' dialog - (carves and shows .lnk files and their offsets)
  • Current User (HKCU) keys which contain Shellink items:
    • 'Software\Microsoft\Windows\Shell\BagMRU'
    • 'Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU'
    • 'Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs'
    • 'Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32':
      • 'OpenSavePidlMRU'
      • 'LastVisitedPidlMRU'
      • 'LastVisitedPidlMRULegacy'
    • 'Software\Microsoft\Windows\CurrentVersion\Explorer\TWinUI\FilePicker\LastVisitedPidlMRU'
    • 'Software\Microsoft\Windows\CurrentVersion\Explorer\Streams'
    • 'Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU'
    • 'Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery'
    • 'Software\Microsoft\Windows\CurrentVersion\Search'
      • 'JumplistData' &
      • 'RecentApps'
    • 'Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband':
      • Favorites'
      • 'FavoritesResolve'
    • 'Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2':
      • 'Favorites'
      • 'FavoritesResolve'
      • 'ProgramsCache'
      • 'ProgramsCacheSMP'
      • 'ProgramsCacheTBP'
    • 'Software\Microsoft\Windows\CurrentVersion\Lock Screen' (Lock screen background image(s))

Features:


Sample screenshots:








[TIP]:

In 'automaticDestinations-ms' files, with the exception of Windows Control Panel, Windows Explorer and Quick Access, entries usually include a 'Hint' on which Application they are related to. These 'hints' are seen in the last IDlist entry (type [32] (File)):

either indirectly:
MPC-HC (Media Player Classic - Home Cinema):

MS Excel:

Edge Browser:

(the "AppXd4nrz8ff68srnhf9t5a8sbjyar1cr723" type entries can be looked up in:
'HKLM::Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\ProgIDs')

or Directly:
Windows Wordpad:

Modern CSV:

Maël Hörz's HxD Hex Editor


References: