[Updates]

• Even more corrections & updates prompted by more variations found during testing & carving,
  such as this:

  

MD5: 9A64126AF9858C21DEAA160E067CF026
SHA256: 41EBB765DC9D4F3DADDDCAC6E46C2C401AFED310DF21CB4EBA16AE2EE9A50807

[Updates]

• Corrections & updates

MD5: 0C952ED60F1920A42E6FB59D603F0A0D
SHA256: 466F1040A6115B1CD5DEA7ADA282B8D60FB0D762FABB2CB51EFD1BA2A0C081DD

[Updates]

• Various improvements & updates including:

  • Added option to save some Nodes to json

  • Expanded option to save the Treeview to json for both trees

  • Added option to carve BEEF0004 itemID extensions (beta)

  • Verification of some of the info contained in ItemIDs:

    

MD5: A5EC9823FCD1719FDF1266BC9D79BBC3
SHA256: 344835CC754B09DF10199CB7B434E6D3737F31E15E91EF30F505C47AED414B7F

[Updates]

• Improvements/corrections in 'automaticDestinations-ms':

  
  

• A few other small corrections & changes

MD5: 2CB3707E750D0389CBB82DB4D184F8A5
SHA256: 5E4AA65E2A355BE682649339A5CD9440575122B79F750512FF287EA4AED4904D

[Updates]

• A few small updates

MD5: C7AF9ABD62AE66A3E8AB36CF96411FF4
SHA256: BF3BFC3A895DDEE2F5CAE697B4AB7BE34E3ECF13D16F69434205423E2B3B0692

[Updates]

• Just for verification:

  Items in 'customDestinations-ms' file:
  
  

  if one of these items is Pinned, an entry for the Pinned item is added to the 'automaticDestinations' file:
  
  

If the [CustomCategory] property is null or Empty, the item is added to the Tasks category. If a value is specified, the item is added to a category that uses the specified name. Items in custom categories can be pinned to the Jump List by the user. When an item is pinned, it moves to an automatic category called Pinned. The user can also remove items from the Jump List.
source

Note: In order for Recent and/or Frequent lists to be populated, the application must be associated with one or more file extensions

MD5: 6D5D5A45716EA286CC211AF59906DE70
SHA256: 32ABB06B825A9DD1E0306EB136F2A11FF75863ED491BD4BB1993B1E8B8F243E0

[Updates]

• Updated 'customDestinations-ms' parsing, e.g.:
  (apparently 'customDestinations-ms' are not just a list of LNKs - values inside the brackets are offsets in the 'customDestinations-ms' file)

  

• Updated 'automaticDestinations-ms' parsing
• A few other changes & updates

MD5: C9402591A35CF2A0C4EFE7649F9D64B8
SHA256: 020D36725B01AAE5D300D3D7DE698207BE6A07A9717823F61E197C5817863884

[Updates]

• Added support for extensions [BEEF000B] & [BEEF001D] etc:

  
  
  
  
  

• Currently supported HKCU keys :

  • 'Software\Microsoft\Windows\Shell\BagMRU'
  • 'Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU'
  • 'Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs'
  • 'Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32' (OpenSavePidlMRU, LastVisitedPidlMRU & LastVisitedPidlMRULegacy)
  • 'Software\Microsoft\Windows\CurrentVersion\Explorer\TWinUI\FilePicker\LastVisitedPidlMRU'
  • 'Software\Microsoft\Windows\CurrentVersion\Explorer\Streams'
  • 'Software\Microsoft\Windows\CurrentVersion\Explorer\StreamMRU'
  • 'Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery'
  • 'Software\Microsoft\Windows\CurrentVersion\Search' (JumplistData & RecentApps) # Items pinned to the Taskbar
  • 'Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband' (Favorites & FavoritesResolve)
  • 'Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage2' (Favorites, FavoritesResolve , ProgramsCache, ProgramsCacheSMP & ProgramsCacheTBP)
  • 'Software\Microsoft\Windows\CurrentVersion\Lock Screen' # Lock screen background image

• Other small corrections & updates

Recommended tools:

• Arsenal Image Mounter
• HxD Editor
• Mitec JSON Viewer
• MFT Browser
• Registry Explorer

MD5: E42A6167D2FBC8412F4D82EF29314525
SHA256: D0E5EA1D265C3989996EA50059F31DB1877EEFC521D9273D81AC8ECD85216985

[Minor Update]

MD5: B907C7B8276C59D567B0C884B1A5DD4A
SHA256: 2ECE48E8111CC51ADE0D8D83E3422298E84EAB98D9455DD2509D0AB5605CFE45

[Updates]

• Small updates

  Just an FYI !!:
  Apparently, the ObjectID MAC address is not necessarily from an Ethernet NIC :

  
  
  
  
  In this case it is from a TP-Link UB500 Bluetooth 5.0 Nano USB Adapter, even though there are 2 active Ethernet NICs as well ;-)

MD5: 5A1545DA2EA5FAC6CEA37E60235303CA
SHA256: F3A985FE65762E7B331F5CD4F9206A2A556AB2212B45383DD8BEE16359FDCC4F