puffyCid / artemis

A cross platform forensic parser written in Rust!

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Add support for Windows Jumplists

puffyCid opened this issue · comments

What new feature do you think would be cool to add to artemis?
Add support for parsing the Windows Jumplist format.

Describe the solution you'd like
Windows Jumplists are forensic artifacts that can provide evidence of file interaction. They can really valuable when trying to determine if a file was opened.

Additional context
This format is very complex. Its a combination of multiple complex Windows formats such as OLE, LNK, and ShellItems.
Luckily artemis already supports parsing LNK and ShellItem formats. So the only format we need to add support for is OLE.

Jumplist format documentation: https://github.com/libyal/dtformats/blob/main/documentation/Jump%20lists%20format.asciidoc
OLE format documentation: https://github.com/libyal/libolecf/blob/main/documentation/OLE%20Compound%20File%20format.asciidoc
Jumplist format blog: https://binaryforay.blogspot.com/2016/02/jump-lists-in-depth-understand-format.html

There might be external crates that can parse the OLE format, but from my brief research they seemed to be unmaintained