File and folder access: LNK files, Jump Lists, RecentDocs and MRU lists

Program execution artifacts (Lesson 2.3) show that a program ran. This lesson shows which files and folders a user opened with it: the automatic shortcuts in the Recent folder, Jump Lists, and the most-recently-used (MRU) lists in the user's NTUSER.DAT. Together they answer some of the most common case questions: which file, from which volume, with which program, and when it was last opened.

LNK files

A Shell Link (LNK) file is a Windows shortcut. Besides the shortcuts users make, Windows creates them automatically: when an application registers a file as recently used (Explorer and the standard open/save dialogs do this), a link is written to %APPDATA%\Microsoft\Windows\Recent, that is C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent. Opening E:\Clients\budget-q3.xlsx creates budget-q3.xlsx.lnk and also Clients.lnk for the parent folder.

There is one automatic LNK per target name. Opening the same file again updates the existing link, and opening a different file with the same name in another folder overwrites it, so the Recent folder keeps only the latest target for each name. Windows also prunes old entries. A privacy setting or Group Policy that turns off recent items can stop both the Recent folder and Jump Lists from being written, so an empty folder is not by itself proof of cleaning.

Structure

All integers are little-endian. The format is documented by Microsoft as [MS-SHLLINK].

So every LNK file begins 4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46. The header times and size describe the target as it was when the link was last updated, not the link itself. If the target was on FAT32, its modified time has 2-second resolution (Lesson 1.5).

The TrackerDataBlock (0x60 bytes) holds the NetBIOS name of the machine on which the target was found (16 bytes, NUL-padded; for a file on a share this is often the file server) and the distributed link tracking IDs (droids): a volume ID and a file object ID, current and at birth. When the file object ID is a version 1 UUID, its last 6 bytes (the node field) often hold the MAC address of the computer that generated it, though the node can also be random.

Timestamps of the LNK file itself

The .lnk file has its own timestamps in the $MFT. For automatic recents the usual interpretation is:

• Created ≈ the first time a file with that name was opened through the shell.
• Modified ≈ the most recent time it was opened.

Treat this as an interpretation to corroborate, not a rule, because other activity can update the link. In a triage collection the copy on your workstation may not keep the original times; read them from the collected $MFT, or from the collection tool's log if it recorded them.

Why LNK files matter

The link survives when the target is deleted, wiped or on a USB drive that is no longer connected. A Recent LNK with drive type removable, a volume serial number and a path on E:\ is key evidence that this user opened that file from that volume. The serial is what ties the link to a specific formatted volume (Lesson 2.6). LECmd parses single files or whole folders, for example LECmd.exe -d <Recent folder> --csv <out>.

Jump Lists

Jump Lists are the per-application recent and pinned lists shown on the taskbar and Start menu. They live next to the Recent LNKs:

• Recent\AutomaticDestinations\<AppID>.automaticDestinations-ms: maintained by Windows. Each is an OLE compound file (signature D0 CF 11 E0 A1 B1 1A E1) containing numbered streams, each a complete LNK, and one stream named DestList.
• Recent\CustomDestinations\<AppID>.customDestinations-ms: written by applications that define their own categories or tasks; the content is a short header followed mainly by LNK structures, not a compound file.

The AppID is a 16-hex-digit hash computed from the application's identity (its AppUserModelID, or its executable path), so it identifies the program that kept the list. Published reference lists map known AppIDs to programs, and JLECmd resolves many of them; for an unknown AppID, the targets' file types and other execution artifacts usually reveal the program.

DestList

The DestList stream has a 32-byte header followed by one entry per item. On Windows 10 and 11 each entry includes:

Entry numbers are issued in increasing order, so a higher number was added to the list later; sorting by last access time gives the MRU order. The embedded LNK carries the drive type, volume serial and target times; the time of use comes from DestList.

Jump Lists often outlive Recent LNKs and record more history. They are keyed by full path, so two files with the same name in different folders keep separate entries; a user who deletes items from the Recent folder rarely touches AutomaticDestinations; and each application keeps its own list, which can hold more items than the taskbar displays. JLECmd parses both kinds, for example JLECmd.exe -d <Recent folder> --csv <out>.

Registry MRU lists

These keys are in the user's NTUSER.DAT under Software\Microsoft\Windows\CurrentVersion\Explorer unless stated otherwise. Many use MRUListEx: 4-byte little-endian value numbers, most recent first, ended by 0xFFFFFFFF. The only time of use they provide is the key's LastWrite (Lesson 2.1), which dates the change at the head of the list.

Microsoft Office and LibreOffice

Office 2016, 2019, 2021, 2024 and Microsoft 365 (all version 16.0) keep their own lists under Software\Microsoft\Office\16.0\<App>\User MRU\<account id>\File MRU, where <App> is Word, Excel or PowerPoint and the account id identifies the signed-in account (for example LiveId_… or ADAL_…). Each Item n value looks like [F00000000][T01DCB128E569DA00][O00000000]*C:\Users\ana\Documents\plan.docx. The [T…] part is a FILETIME in hexadecimal: 0x01DCB128E569DA00 = 134,176,878,120,000,000, which is 2026-03-11T07:30:12Z. It is a per-file time, which RecentDocs cannot give. A sibling Place MRU key lists folders.

LibreOffice does not use these keys; it keeps recent documents as file:/// URLs in its user profile file registrymodifications.xcu (under %APPDATA%\LibreOffice\4\user).

Worked example: when was budget-q3.xlsx last opened?

The triage collection of ana's computer, DESKTOP-7QK2M1F (Windows 11), contains an Excel Jump List in AutomaticDestinations and Recent\budget-q3.xlsx.lnk.

1. DestList. JLECmd lists entry 26: path E:\Clients\budget-q3.xlsx, NetBIOS name DESKTOP-7QK2M1F, access count 4, pin status -1, last access FILETIME 0x01DCB3BA13F1E0A0. Convert it: 0x01DCB3BA13F1E0A0 = 134,179,700,694,180,000 hundred-nanosecond intervals; ÷ 10,000,000 = 13,417,970,069.418 s since 1601; − 11,644,473,600 = Unix time 1,773,496,469.418 = 2026-03-14T13:54:29.418Z.

2. Embedded LNK. Entry 26 = 0x1A, so open stream 1a: drive type 2 (removable), drive serial bytes 4D 3C 2B 1A, read little-endian as 0x1A2B3C4D and displayed 1A2B-3C4D, label CLIENTS.

3. Recent LNK. budget-q3.xlsx.lnk has the same path, drive type and serial. Its header holds the target's modified time 2026-03-12T13:02:40Z and size 48,640 bytes. From the collected $MFT, the .lnk itself was created 2026-03-11T07:30:12Z and modified 2026-03-14T13:54:30Z.

4. Compare. The LNK modification is 0.582 s after the DestList time. Different components write the two artifacts during the same open, so a gap of a second or two is normal. The volume serial in both matches the USB image's boot sector (Lesson 2.6). The LNK creation suggests a first open on 2026-03-11, and the count shows at least four uses.

Answer: last opened at 2026-03-14T13:54:29Z (truncated to seconds), from the Excel Jump List, corroborated by the Recent LNK. Always write UTC with Z; never copy a time a tool displayed in local time without converting it.

Choosing and corroborating

Exam focus: Expect questions asking when a file was last opened, from which volume or by which program, with an exact UTC time, a full path or a volume serial as the answer. Know where each artifact lives in a triage collection, how a DestList entry number maps to a hexadecimal stream name, and that LNK header times belong to the target. Be ready to explain why RecentDocs dates only its most recent entry.

Key points

• Automatic LNKs in %APPDATA%\Microsoft\Windows\Recent record the target's path, times, size, drive type, volume serial and machine name, and survive the target's deletion or removal.
• One Recent LNK exists per target name; its own created and modified times usually approximate first and last open, to be corroborated.
• AutomaticDestinations Jump Lists are compound files with numbered LNK streams and a DestList holding last access time, access count, pin status and path per item.
• MRUListEx gives order; a key's LastWrite dates only the entry at its head. Office File MRU [T…] values give per-file FILETIMEs.
• Answer "last opened" from DestList, corroborate with the LNK, and report UTC with Z.