jumplist_parser 0.1.0

A Rust library to parse Windows Jumplist files (automaticDestinations-ms and customDestinations-ms)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98

# Jumplist Parser


[![Crates.io](https://img.shields.io/crates/v/jumplist_parser)](https://crates.io/crates/jumplist_parser)
[![Docs.rs](https://docs.rs/jumplist_parser/badge.svg)](https://docs.rs/jumplist_parser)
[![License: MIT OR Apache-2.0](https://img.shields.io/crates/l/jumplist_parser)](#license)

This repository is a Rust library and CLI tool for parsing **Windows Jumplist artifacts**

## 🔍 What Are Jumplists?


Windows Jumplists are Windows artifacts that provides quick access to recently or frequently used files per application. They are stored under:

```
%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\*
%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\*
````

These files contain structured metadata such as:

- File paths and names
- Timestamps (last accessed, modified)
- Hostname where files were opened
- LNK metadata (command-line arguments, working directory, etc)
- Pinned items
- And many more!

Jumplists are extremely useful in **incident response**, **timeline analysis**, and **user activity reconstruction**. If you want to know more about this artifact, I wrote a blog post about its structure here: [u0041.co](https://u0041.co/posts/articals/jumplist-files-artifacts/)

## 📦 Installation


Install the commandline tool using `cargo`:

```bash
cargo install jumplist_parser
````

Once installed, you can run the binary to see available arguments:

```bash
jumplist_parser --help
```

```bash
Created By: AbdulRhman Alfaifi <@A__ALFAIFI>
Version: v0.1.0
Reference: https://u0041.co/posts/articals/jumplist-files-artifacts/

Windows Jumplist Files Parser

Usage: jumplist_parser [OPTIONS]

Options:
  -p, --path <PATH>                    Path(s) to Jumplist files to be parsed - accepts glob (defaults to 'AutomaticDestinations' & 'CustomDestinations' for all users)
  -o, --output <FILE>                  The file path to write the output to [default: stdout]
      --output-format <output-format>  Output format [default: csv] [possible values: csv, jsonl, json]
      --no-headers                     Don't print headers when using CSV as the output format
      --normalize                      Normalize the result to the most important fields
  -h, --help                           Print help
  -V, --version                        Print version
```

Or you can download the latest version from the [release section](https://github.com/AbdulRhmanAlfaifi/jumplist_parser/releases/latest)

## 🧪 Using the Library


### 1️⃣ Add to `Cargo.toml`


```toml
[dependencies]
jumplist_parser = "0.1.0"
```

### 2️⃣ Parse a Jumplist File


```rust
use jumplist_parser::JumplistParser;

fn main() -> Result<(), Box<dyn std::error::Error>> {
    let parser = JumplistParser::from_path("samples/win11/AutomaticDestinations/4cb9c5750d51c07f.automaticDestinations-ms")?;

    println!("App ID: {:?}", parser.app_id);
    println!("{:#?}", parser);

    Ok(())
}
```

## 📝 License


Licensed under either of:

* MIT
* Apache License, Version 2.0

## 📚 References

* [My blog post for Jumplist artifact - u0041.co](https://u0041.co/posts/articals/jumplist-files-artifacts/)
* [LNK Strcuture](https://u0041.co/posts/articals/lnk-files-artifact/)
* [LNK Parser](https://github.com/AbdulRhmanAlfaifi/lnk_parser)