10

Here you can see the Conext Menu

Question states it already. I want to know where the Pinned File is located on the hard drive. I can open it with a left-click. I can not search for it because of #!$%§ windows see Image number 2.

No Results found for *.rdp - because you know ... windows ...

A right-click with all the known modifiers (alt-shift-ctrl in every combination) just gives a single item context menu of "Open". Is there something i am missing? Where is the real context-menu?

Thanks for your help in advance.

edit: Yes i see the related questions. But none are asking for the files - they ask for the pinned applications. As you can see in the first Image i want to get the location of the first pinned file.

Stephan Schinkel
  • 203
  • 1
  • 7
  • 1
    This SO Windows 7 link may be of interest: http://stackoverflow.com/questions/2945320/where-is-win7s-jump-list-system-data-stored ... it seems the data is stored in files but I've no idea how to open the file (they have some binary content)... a Hex program showed some content but not sure how I'd go about adding,editing or deleting without looking to VisualStudio and writing using programming for Windows – Kinnectus Dec 15 '15 at 08:55
  • You can analyze the jump lists of Remote Desktop by [analyzing 1bc392b8e104a00e.automaticDestinations-ms](https://superuser.com/a/786287/167187) – Vinayak Dec 18 '15 at 22:49
  • You can use [JumpLister by Mark Woan](http://www.woanware.co.uk/forensics/jumplister.html) or [MiTeC's Structured Storage Viewer](http://www.mitec.cz/ssv.html) to see if you can find what you're looking for. Looking through the strings in SSViewer's `As Text` view may help too. – Vinayak Dec 18 '15 at 23:59
  • could it be the file does no longer exist? Try to add another one (which *is* existing for sure), and see if the right-click gives more options. – Aganju Dec 21 '15 at 22:41

3 Answers3

8

These files are located in the jump-lists folders, which are divided into two kinds.

  • The ones the operating system creates and maintains store information about data file usage and are to be found in files named like this : %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\[AppID].automaticDestinations-ms.

  • The ones maintained by specific applications responsible for that specific destination file are to be found in files named like this : %APPDATA%\Microsoft\Windows\Recent\CustomDestinations\[AppID].customDestinations-ms.

The names for the files are not very informative, so one has to look into their content in order to find more information. Some AppIDs can be found in the List of Jump List IDs.

Much information about jump-lists is found in the description of Windows Jump List Parser (jmp) - a free utility that can be used to parse these jump-list files.

Below is a screenshot of the types of information that can be extracted by using jmp :

image

I have not tried this product, but from the above screenshot it seems that to see the target file one must use the paid version of jmp ($210).

In that case, use the information from the article ForensicsWiki : Jump Lists :

image2

harrymc
  • 455,459
  • 31
  • 526
  • 924
  • FYI the links in your answer no longer work. The one for jump list IDs has moved to https://forensicswiki.xyz/wiki/index.php?title=List_of_Jump_List_IDs and jump list parser seems to now be located at https://tzworks.com/prototype_page.php?proto_id=20 – Andris Aug 26 '22 at 17:13
3

The technical term is a jump list.

NirSoft JumpListView should help you in listing the details of the jump list and providing the paths.

Search Everything should also find them, as long as they are located on a local hard disk. This tool will not analyze the jump list, but read the MFT directly.

Thomas Weller
  • 5,704
  • 11
  • 55
  • 100
  • Another decent parser I just found (JumpList Explorer) is available from Eric Zimmerman: https://ericzimmerman.github.io/ – Andris Aug 26 '22 at 18:03
-3

You can find pinned apps in:

%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar

and for the start menu apps go to:

%AppData%\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu

Check this original Source : Where is the list of pinned start menu and taskbar items stored in Windows 7

Community
  • 1
BrotskyTv
  • 322
  • 1
  • 6
  • 2
    I'm sorry to say but: this is just the list of pinned apps. This is NOT the list of pinned files - as i have stated in my question. – Stephan Schinkel Oct 06 '15 at 14:07