{"id":13679819,"url":"https://github.com/kacos2000/Jumplist-Browser","last_synced_at":"2025-04-29T19:32:05.938Z","repository":{"id":63493250,"uuid":"566443637","full_name":"kacos2000/Jumplist-Browser","owner":"kacos2000","description":"Automatic/Custom Destinations \u0026 LNK (MS-SHLLINK) Browser","archived":false,"fork":false,"pushed_at":"2024-02-25T21:44:26.000Z","size":13915,"stargazers_count":32,"open_issues_count":0,"forks_count":2,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-07T20:43:47.856Z","etag":null,"topics":["00021401-0000-0000-c000-000000000046","1sps","automaticdestinations-ms","customdestinations-ms","fmid","forensic","gui","gui-application","jumplist","link","lnk","mrulist","ms-shllink","powershell","propertylist","shell","shellbag","shelllnk","shortcut","windows"],"latest_commit_sha":null,"homepage":"https://kacos2000.github.io/Jumplist-Browser/","language":"PowerShell","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kacos2000.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":".github/FUNDING.yml","license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null},"funding":{"github":["kacos2000"],"patreon":null,"open_collective":null,"ko_fi":null,"tidelift":null,"community_bridge":null,"liberapay":null,"issuehunt":null,"otechie":null,"lfx_crowdfunding":null,"custom":null}},"created_at":"2022-11-15T17:27:30.000Z","updated_at":"2025-03-05T01:42:37.000Z","dependencies_parsed_at":"2024-08-02T13:18:46.151Z","dependency_job_id":"2960dc90-c31d-4c57-9f14-504444a219a0","html_url":"https://github.com/kacos2000/Jumplist-Browser","commit_stats":null,"previous_names":[],"tags_count":56,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kacos2000%2FJumplist-Browser","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kacos2000%2FJumplist-Browser/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kacos2000%2FJumplist-Browser/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kacos2000%2FJumplist-Browser/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kacos2000","download_url":"https://codeload.github.com/kacos2000/Jumplist-Browser/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":251569549,"owners_count":21610575,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["00021401-0000-0000-c000-000000000046","1sps","automaticdestinations-ms","customdestinations-ms","fmid","forensic","gui","gui-application","jumplist","link","lnk","mrulist","ms-shllink","powershell","propertylist","shell","shellbag","shelllnk","shortcut","windows"],"created_at":"2024-08-02T13:01:09.930Z","updated_at":"2025-04-29T19:32:00.922Z","avatar_url":"https://github.com/kacos2000.png","language":"PowerShell","funding_links":["https://github.com/sponsors/kacos2000"],"categories":["PowerShell"],"sub_categories":[],"readme":"## Jumplist-Browser\nAutomatic/Custom Destinations \u0026amp; LNK (ShellLNK) Browser\n\n==\u003e [Latest version](https://github.com/kacos2000/Jumplist-Browser/releases/latest) \u003c==\n\n___________________________________________\nDependencies: \n- Operating system: Microsoft Windows 10+ 64 Bit\n- [.NET Framework 4.8](https://dotnet.microsoft.com/en-us/download/dotnet-framework/net48)\n- [Powershell Version:  5.1](https://docs.microsoft.com/en-us/powershell/scripting/windows-powershell/install/windows-powershell-system-requirements?view=powershell-5.1)\n___________________________________________\nSupports:\n   - Link: (.lnk) shortcut files\n   - Frequent Places Lists: '.customDestinations-ms' and '.automaticDestinations-ms' files\n   - Raw image files: '.001', '.raw','.dd', '.img', '.ima' *via the 'Open File' dialog* - *(carves and shows .lnk files and their offsets)* \n   - Current User (HKCU) keys which contain Shellink items:\n      - 'Software\\Microsoft\\Windows\\Shell\\BagMRU'\n      - 'Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\Shell\\BagMRU'\n      - 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RecentDocs'\n      - 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ComDlg32\\':\n         - 'OpenSavePidlMRU'\n         - 'LastVisitedPidlMRU'\n         - 'LastVisitedPidlMRULegacy'\n      - 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\TWinUI\\FilePicker\\LastVisitedPidlMRU'\n      - 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Streams'\n      - 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StreamMRU'\n      - 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\WordWheelQuery'\n      - 'Software\\Microsoft\\Windows\\CurrentVersion\\Search'\n         - 'JumplistData' \u0026\n         - 'RecentApps'\n      - 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Taskband':\n         - Favorites'\n         - 'FavoritesResolve'\n      - 'Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartPage2':\n         - 'Favorites'\n         - 'FavoritesResolve'\n         - 'ProgramsCache'\n         - 'ProgramsCacheSMP'\n         - 'ProgramsCacheTBP'\n      - 'Software\\Microsoft\\Windows\\CurrentVersion\\Lock Screen' *(Lock screen background image(s))*\n   \n___________________________________________\nFeatures:\n   - Shows the [64-bit file size *(when a target file size is greater than 4Gb (0xFFFFFFFF))*](https://github.com/kacos2000/Jumplist-Browser/releases/tag/v.0.0.37.0)\u003cbr\u003e\n     *(DWORD nFileSizeHigh + DWORD nFileSizeLow)*\n   - Shows [Reparse Point Tags](https://github.com/kacos2000/Jumplist-Browser/releases/tag/v.0.0.33.0) \u0026 their description\n   - Shows customDestinations ['CustomCategory' titles](https://github.com/kacos2000/Jumplist-Browser/assets/11378310/0c1f9909-59ce-4330-b036-a21d995a1406)\n   - Shows Pin Entry *(item order)* number of pinned items in automaticDestinations-ms\n   - Shows Quick Access position *(item order)* in automaticDestinations-ms\n   - Supports the 'DestListPropertyStore' stream in automaticDestinations-ms\n   - Supports PropertyStore extensions in automaticDestinations-ms 'DestList' stream entries \n   - Shows Serialized Property descriptions for most [FormatID/PropertyID combinations](https://github.com/kacos2000/Jumplist-Browser/blob/master/FormatID-Descriptions.csv)\n   - Shows the [Application name](https://github.com/kacos2000/Jumplist-Browser/blob/master/AppIdlist.csv) for known [CRC64 hashes](https://www.hexacorn.com/blog/2013/04/30/jumplists-file-names-and-appid-calculator/) in Destinations-ms files\n   - Resolves CLSIDs, [SID](https://github.com/kacos2000/Jumplist-Browser/releases/tag/v.1.0.3.0)s, File Attribute \u0026 SFGAO flags, Stock Icon IDs, [MAC address/manufacturer](https://github.com/kacos2000/Jumplist-Browser/releases/tag/v.1.0.5.0) etc\n   - [Single executable *(x64)*](https://github.com/kacos2000/Jumplist-Browser/releases/latest) =\u003e can be used with [Arsenal Image Mounter](https://arsenalrecon.com/products/arsenal-image-mounter) \u0026 [Virtual machines](https://github.com/kacos2000/Jumplist-Browser/assets/11378310/5371c027-3155-4d81-9d32-b7035ea510fa)\n   - Can [export to .JSON](https://github.com/kacos2000/Jumplist-Browser/releases/tag/v.0.0.52.0)\n\n___________________________________________\nSample screenshots:\u003cbr\u003e\n\n  \u003cimg src=\"https://github.com/kacos2000/Jumplist-Browser/assets/11378310/f2f7e462-9f1c-4c07-a4d3-3ce340730905\" width=\"600\"\u003e\u003cbr\u003e\n\n  \u003cimg src=\"https://github.com/kacos2000/Jumplist-Browser/assets/11378310/93336ab3-64a9-4c03-acfd-120c17327712\" width=\"600\"\u003e\u003cbr\u003e\n\n  \u003cimg src=\"https://github.com/kacos2000/Jumplist-Browser/assets/11378310/afa43473-6f70-4b76-b6ce-366458c6eb17\" width=\"500\"\u003e\n\n  \u003cimg src=\"https://github.com/kacos2000/Jumplist-Browser/assets/11378310/d3f08278-59a0-404f-a95d-bde23d2432f1\" width=\"600\"\u003e\u003cbr\u003e\n\n  \u003cimg src=\"https://user-images.githubusercontent.com/11378310/220356910-0085c017-c4c1-45da-96a0-24f7be69f13f.png\" width=\"500\"\u003e\n\n  \u003cimg src=\"https://github.com/kacos2000/Jumplist-Browser/assets/11378310/8c57f55f-1fc0-4f81-bcbf-b18207695243\" width=\"500\"\u003e\u003cbr\u003e\n\n  \u003cimg src=\"https://github.com/kacos2000/Jumplist-Browser/assets/11378310/474966bd-a77b-4f9f-9775-b9f2dbb9abeb\" width=\"500\"\u003e\u003cbr\u003e\n\n  \u003cimg src=\"https://user-images.githubusercontent.com/11378310/220354146-a502d9bf-3b04-454a-ae37-a41db1899c15.png\" width=\"500\"\u003e\u003cbr\u003e\n\n\u003c!-- Commented out --\u003e\n\u003c!-- ![image](https://user-images.githubusercontent.com/11378310/212580495-e4c6afe8-68a3-4504-b831-b92c1728b36a.png) --\u003e\n\n---------------------------------------------------------------------------------------------------------------\n\n### [TIP]:\nIn **'automaticDestinations-ms'** files, with the exception of *Windows Control Panel*, *Windows Explorer* and *Quick Access*, \nentries usually include a 'Hint' on which Application they are related to. \nThese 'hints' are seen in the last IDlist entry (type [32] *(File)*):\n\neither indirectly: \u003cbr\u003e\nMPC-HC *(Media Player Classic - Home Cinema)*:\u003cbr\u003e\n  \u003cimg src=\"https://user-images.githubusercontent.com/11378310/219865398-65ceda89-8e6c-4a53-9f20-228d1fda0458.png\" width=\"300\"\u003e\u003cbr\u003e\nMS Excel:\u003cbr\u003e\n  \u003cimg src=\"https://user-images.githubusercontent.com/11378310/219865245-1f6203be-08df-4499-bb70-27b13ce87ab1.png\" width=\"300\"\u003e\u003cbr\u003e\nEdge Browser:\u003cbr\u003e\n  \u003cimg src=\"https://github.com/kacos2000/Jumplist-Browser/assets/11378310/d4761eeb-5b1b-4aa9-8470-f5cf692a2a34\" width=\"500\"\u003e\u003cbr\u003e\n*(the \"**AppX**d4nrz8ff68srnhf9t5a8sbjyar1cr723\" type entries can be looked up in:\u003cbr\u003e\n'HKLM::Software\\Classes\\Local Settings\\Software\\Microsoft\\Windows\\CurrentVersion\\AppModel\\PackageRepository\\Extensions\\ProgIDs')*\n\nor Directly:\u003cbr\u003e\nWindows Wordpad:\u003cbr\u003e\n  \u003cimg src=\"https://user-images.githubusercontent.com/11378310/219865461-223076e7-4195-4089-97e3-6a8b00baa5bd.png\" width=\"300\"\u003e\u003cbr\u003e\nModern CSV:\u003cbr\u003e\n  \u003cimg src=\"https://user-images.githubusercontent.com/11378310/219865578-234ea46d-0ac0-4fca-afaa-64a870501137.png\" width=\"300\"\u003e\u003cbr\u003e\nMaël Hörz's [HxD Hex Editor](https://mh-nexus.de/en/hxd/)\u003cbr\u003e\n  \u003cimg src=\"https://user-images.githubusercontent.com/11378310/221018836-62cbc8e4-4dbf-4eda-8892-82230db48c0f.png\" width=\"300\"\u003e\u003cbr\u003e\n\n___________________________________________\nReferences:\n- [Shell Link (.LNK) Binary File Format](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/a6c2f32d-2297-4727-bcd3-5d3669573bcb)\u003cbr\u003e\n  *The most important component of a link target namespace is a link target in the form of an item ID list (IDList)*\n- [Serialized Property Store](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-propstore/3453fb82-0e4f-4c2c-bc04-64b4bd2c51ec)\n- [Shell Namespace](https://learn.microsoft.com/en-us/windows/win32/shell/namespace-intro?redirectedfrom=MSDN)\n- [Windows Data Types](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/cca27429-5689-4a16-b2b4-9325d93e4ba2)\n- [LnkSearchMachine](https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dltw/6cbc37d6-c74a-4078-8030-19d4de1807bf)\u003cbr\u003e\n   *FileLocation: A VolumeID with an appended ObjectID, which together represent the location of a file at some point in time, though the file might no longer be there. FileLocation values are stored in droid (CDomainRelativeObjId) data structures.*\n  \n---------------------------------------------------------------------------------------------------------------\n- **Note:** *Uses the following Libraries:*\n   - [ShellLink .NET Class Library](https://github.com/securifybv/ShellLink) and\n   - [PropertyStore .NET Class Library](https://github.com/securifybv/PropertyStore)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkacos2000%2FJumplist-Browser","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkacos2000%2FJumplist-Browser","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkacos2000%2FJumplist-Browser/lists"}