# Link Files and Jump Lists

**URL:** <https://sleuthkit.discourse.group/t/link-files-and-jump-lists/5566>\
**Category:** The Sleuth Kit Development\
**Created:** [May 3, 2026, 3:26am UTC](https://sleuthkit.discourse.group/t/link-files-and-jump-lists/5566 "2026-05-03T03:26:19Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sakar](https://avatars.discourse-cdn.com/v4/letter/s/dec6dc/32.png) [@Sakar](https://sleuthkit.discourse.group/u/Sakar)\
**Post date:** [May 3, 2026, 3:26am UTC](https://sleuthkit.discourse.group/t/link-files-and-jump-lists/5566/1 "2026-05-03T03:26:19Z")

</div>

**Context/Goal**  
I am currently finalizing a paper on Windows Shell artifact generation and wanted to share some experimental findings regarding the interaction between applications and `shell32.dll`. My goal is to understand why command-line interfaces (CLIs) like `CMD` and `PowerShell` do not generate Jump Lists.

**Problem/Observation**  
Standard file operations performed via `CMD` or `PowerShell` do not result in updates to `AutomaticDestinations` or the `Recent folder`, making them forensically “invisible” to these artifacts.

**Experimental Steps**

1. Using `ProcMon`, I confirmed that standard file operations (e.g., `mkdir`, `echo`, `New-Item`) executed through `CMD` or `PowerShell` generate **zero** updates to `AutomaticDestinations` or the `Recent folder`.

2. I wiped all `*.automaticDestinations-ms` files. Creating files via the CLI did not trigger a re-initialization of these files.

3. I manually invoked the Win32 API `SHAddToRecentDocs` within a PowerShell session using the following C# P/Invoke signature:

**Results/Observations**  
When `SHAddToRecentDocs` was manually invoked, `ProcMon` captured `powershell.exe` interacting with `explorer.exe`. `explorer.exe` then acted as the “clerk” to write the `LNK` and Jump List files.

**Conclusion**  
CLI tools are forensically “invisible” to Jump List and Recent folder artifacts because they lack a static dependency on `shell32.dll` and do not perform the necessary notification required by the Shell. This confirms that the absence of a Jump List entry does not necessarily mean no activity occurred.

**Questions for the Community**

1. Has anyone observed modern CLI tools (such as `Windows Terminal` or specific 3rd party shells) that _do_ explicitly call the `SHAddToRecentDocs` API?

I am looking forward to any insights or critiques before I submit the final paper.

Windows Build/Version

Windows 11 Home 25H2 26200.8246

I apologize if this is not the right place for to ask this. I would appreciate if you could point me to the right location.