AUTOMATICDESTINATIONS-MS

Generated by scripts/gen-format-pages.py from docs/data/format-metadata/, FILE_FORMATS.csv and docs/formats-master.csv. Do not edit by hand: change the source, then run the script.

Windows JumpList Preview.

At a glance

How much Poka reads

B3 Core. Only the main content type or types are decoded (for example geometry but not materials, layers or annotations, or only one version family). The list of gaps is substantial.

Confidence: medium (the reviewer read the code). Basis: Reviewed 2026-10-26: read parsers/poka-jumplist/src/main.rs (966 lines) and plugin.json. The unit test parses_sample_destlist reads the corpus jumplist sample. Covers .automaticDestinations-ms and .customDestinations-ms. The tree reads the compound file and the DestList stream (versions 1, 3 and 4): app ID, entry and pinned counts, and each entry's path, access time and position; the embedded LNK streams are listed. Judgement: B3: the recent-items list is decoded, but the embedded shortcuts are not.

What Poka does not read

• The embedded LNK streams are listed, not decoded
• Host names, volume and file droids and MRU details are not shown (judgement from the code)
• customDestinations-ms files are not compound files and are refused, although the extension is routed here (judgement from the code)
• Only the first 200 entries are listed

Libraries

Libraries Poka uses or has assessed for this format, with the status, licence and language the registry records.

• jumplist_parser (candidate; MIT OR Apache-2.0; Rust; https://github.com/AbdulRhmanAlfaifi/jumplist_parser) — Library and CLI for automaticDestinations-ms and customDestinations-ms; v0.1.0, early stage
• lnk-core (candidate; Apache-2.0; Rust; https://docs.rs/crate/lnk-core/latest) — Shell Link reader; crate description mentions Automatic/Custom Destinations Jump Lists but the README only covers LNK; licence taken from a badge; repo at github.com/SecurityRonin/lnk-forensic

Sources

• parsers/poka-jumplist/src/main.rs
• parsers/poka-jumplist/plugin.json