JLECmd (jump lists)

JLECmd.exe -d <profile> --csv <out>

Parse Windows Jump Lists with JLECmd, revealing the files the user recently opened from applications.

Run it when you need to know what files the user (or the attacker with their session) opened: Jump Lists (in %APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations and CustomDestinations) record recent documents per application — and JLECmd converts them to CSV with the file, the application, and timestamps. It's the user activity artifact: the phishing document they opened, the payload executed from an app, the files the attacker touched with the compromised session. In IR, Jump Lists answer 'what did this user open and when?' — activity with specific applications.

Don't use it as a complete activity log: Jump Lists cover files opened from supported applications — not all apps generate Jump Lists, and console or script activity doesn't appear. Retention is limited (lists are pruned with new usage). And watch the interpretation: Jump Lists show activity for the user profile — if the attacker used another account or another user's session, the artifact is in that other profile. For temporal correlation, Jump List timestamps are cross-referenced with the MFT and Prefetch of the opened file.