IT Forensics – Windows

Forensic analysis of jump lists – Important insights into user activity

Jump Lists are among the most revealing artefacts in modern Windows systems. They store information about frequently used or recently used files, folders and applications, and can therefore provide valuable insights into user activity. In the context of professional Windows forensics, jump lists are never examined in isolation. Only when analysed in conjunction with other artefacts is it possible to objectively reconstruct technical processes.

Enquire without obligation

Why LanCologne?

Since its foundation, LanCologne has specialised in professional IT forensics. Our staff have decades of experience in the field of information technology and assist companies, solicitors, private individuals and, on a regular basis, the courts in the technical investigation of complex digital matters.

The examination is, as a matter of principle, carried out exclusively on a forensic copy or a forensic image. The original evidence remains unchanged and is stored in a manner that preserves its evidential integrity.

Our services

We analyse jump lists for open files, target paths, time information and other metadata. The results are correlated with artefacts such as LNK files, the Windows Registry, the Master File Table (MFT), the USN Journal and the event logs to enable robust technical findings.

Typical areas of application

•Reconstruction of opened documents
•Analysis of user activity
•Data theft
•Allegations of manipulation
•Employment law proceedings
•Incident Response
•Expert reports for the courts

This is how a forensic analysis of jump lists is carried out

Once a forensic image has been created, any existing jump lists are identified and analysed. The information they contain is compared with other Windows artefacts and placed in chronological order. All stages of the investigation are fully documented.

Why are jump lists so important?

Jump Lists often provide clues as to which files and applications have actually been used. However, their significance only becomes apparent through the comprehensive analysis of all relevant digital traces within an investigation.

Frequently Asked Questions

What are jump lists?+
Windows artefacts containing information about recently used or frequently used files and applications.
Will the original be examined?+
No. Only a forensic copy or forensic image is analysed.
Can Jump Lists show deleted files?+
You can provide details of files used previously. The technical assessment is always carried out within the overall context.
Are jump lists alone sufficient for an expert report?+
No. They are always analysed alongside other artefacts.

LanCologne – Windows Forensics in Cologne

Do you need a professional analysis of jump lists or other Windows artefacts? LanCologne can assist you with the forensic preservation of digital evidence and the objective analysis of complex Windows systems.

Get in touch now