LNK & Jumplist Browser

[Updates]

• Even more corrections & updates prompted by more variations found during testing & carving,
  such as this:

  

---

MD5: 9A64126AF9858C21DEAA160E067CF026
SHA256: 41EBB765DC9D4F3DADDDCAC6E46C2C401AFED310DF21CB4EBA16AE2EE9A50807

LNK & Jumplist Browser

[Updates]

• Corrections & updates

---

MD5: 0C952ED60F1920A42E6FB59D603F0A0D
SHA256: 466F1040A6115B1CD5DEA7ADA282B8D60FB0D762FABB2CB51EFD1BA2A0C081DD

LNK & Jumplist Browser

[Updates]

• Various improvements & updates including:

  • Added option to save some Nodes to json

  • Expanded option to save the Treeview to json for both trees

  • Added option to carve BEEF0004 itemID extensions (beta)

  • Verification of some of the info contained in ItemIDs:

    

---

MD5: A5EC9823FCD1719FDF1266BC9D79BBC3
SHA256: 344835CC754B09DF10199CB7B434E6D3737F31E15E91EF30F505C47AED414B7F

LNK & Jumplist Browser

[Updates]

• Improvements/corrections in 'automaticDestinations-ms':

  
  

• A few other small corrections & changes

---

MD5: 2CB3707E750D0389CBB82DB4D184F8A5
SHA256: 5E4AA65E2A355BE682649339A5CD9440575122B79F750512FF287EA4AED4904D

LNK & Jumplist Browser

[Updates]

• A few small updates

---

MD5: C7AF9ABD62AE66A3E8AB36CF96411FF4
SHA256: BF3BFC3A895DDEE2F5CAE697B4AB7BE34E3ECF13D16F69434205423E2B3B0692

LNK & Jumplist Browser

[Updates]

• Just for verification:

  Items in 'customDestinations-ms' file:
  
  

  if one of these items is Pinned, an entry for the Pinned item is added to the 'automaticDestinations' file:
  
  

If the [CustomCategory] property is null or Empty, the item is added to the Tasks category. If a value is specified, the item is added to a category that uses the specified name. Items in custom categories can be pinned to the Jump List by the user. When an item is pinned, it moves to an automatic category called Pinned. The user can also remove items from the Jump List.
source

Note: In order for Recent and/or Frequent lists to be populated, the application must be associated with one or more file extensions

---

MD5: 6D5D5A45716EA286CC211AF59906DE70
SHA256: 32ABB06B825A9DD1E0306EB136F2A11FF75594ED491BD4BB1993B1E8B8F243E0

LNK & Jumplist Browser

[Updates]

• Updated 'customDestinations-ms' parsing, e.g.:
  (apparently 'customDestinations-ms' are not just a list of LNKs - values inside the brackets are offsets in the 'customDestinations-ms' file)

  

• Updated 'automaticDestinations-ms' parsing
• A few other changes & updates

---

MD5: C9402591A35CF2A0C4EFE7649F9D64B8
SHA256: 020D36725B01AAE5D300D3D7DE698207BE6A07A9717823F61E197C5817594884

LNK & Jumplist Browser

[Updates]

• Added support for extensions [BEEF000B] & [BEEF001D] etc:

  
  
  
  
  

• Currently supported HKCU keys :

  • 'Software\Microsoft\Windows\Shell\BagMRU'
  • 'Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU'
  • 'Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs'
  • 'Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32' (OpenSavePidlMRU, LastVisitedPidlMRU & LastVisitedPidlMRULegacy)
  • 'Software\Microsoft\Windows\CurrentVersion\Explorer\TWinUI\FilePicker\LastVisitedPidlMRU'
  • 'Software\Microsoft\Windows\CurrentVersion\Explorer\Streams'
  • 'Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU'
  • 'Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery'
  • 'Software\Microsoft\Windows\CurrentVersion\Search' (JumplistData & RecentApps) # Items pinned to the Taskbar
  • 'Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband' (Favorites & FavoritesResolve)
  • 'Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2' (Favorites, FavoritesResolve , ProgramsCache, ProgramsCacheSMP & ProgramsCacheTBP)
  • 'Software\Microsoft\Windows\CurrentVersion\Lock Screen' # Lock screen background image

• Other small corrections & updates

---

Recommended tools:

• Arsenal Image Mounter
• HxD Editor
• Mitec JSON Viewer
• MFT Browser
• Registry Explorer

---

MD5: E42A6167D2FBC8412F4D82EF29314525
SHA256: D0E5EA1D265C3989996EA50059F31DB1877EEFC521D9273D81AC8ECD85216985

LNK & Jumplist Browser

[Minor Update]

---

MD5: B907C7B8276C59D567B0C884B1A5DD4A
SHA256: 2ECE48E8111CC51ADE0D8D83E3422298E84EAB98D9455DD2509D0AB5605CFE45

LNK & Jumplist Browser

[Updates]

• Small updates

  Just an FYI !!:
  Apparently, the ObjectID MAC address is not necessarily from an Ethernet NIC :

  
  
  
  
  In this case it is from a TP-Link UB500 Bluetooth 5.0 Nano USB Adapter, even though there are 2 active Ethernet NICs as well ;-)

---

MD5: 5A1545DA2EA5FAC6CEA37E60235303CA
SHA256: F3A985FE65762E7B331F5CD4F9206A2A556AB2212B45383DD8BEE16359FDCC4F