drop automaticDestinations file listing and mft csv · detect cleared or emptied jump list files · identify applications with cleared jump lists despite evidence of use · surface selective jump list destruction targeting specific applications · runs locally
sources
drop destinations listing · MFT · prefetch · shimcache
or click
<500B .automaticDestinations-ms · recent modification · MFT near-zero size · AppId missing despite prefetch · selective vs bulk clearing
drop AutomaticDestinations listing · MFT csv filtered to jump list paths · prefetch/shimcache csv