Jump lists are a feature of the Windows Taskbar and Start Menu, allowing a user to quickly access common tasks and files associated with a program by right-clicking on the program. Windows records a history of these recently accessed files stored, even when not directly viewable by the user. Jump lists can provide us with a lot more information about a user’s history, for example:
- Modified, access and created timestamps of a file
- History of uploaded and downloaded files through a web browser
- History of files and folder even after a user deletes them
These are a lesser known usability function and as such, less likely to be targeted for counter forensic measures by a novice user. As such, Jump Lists have proven to be a robust source of evidence for an analyst to help construct a detailed timeline of what files and folders the user was accessing.