Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
Modules
· Home
· Content
· FAQ
· Forensic Downloads
· Forensics Feedback
· Forums
· Members List
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: momu189
New Today: 0
New Yesterday: 2
Overall: 29619

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 How much can be found?
 Computer Forensic in responding to Data Breach issues
 A bunch of numbers about digital evidences collection
 Computer forensic issue
 A Survey on the Internet of Things Digital Forensic Research

Computer Forensics World Forums


Pages Served
We received
58183590
page views since August 2004

Security Sources

FTC
OnGuard Online
ISO 17799 ISO 27001
ISO 27000 Toolkit
ISO 27001 & 27000
Cryptography
Security Policies

Computer Forensics World: Forums

Computer Forensics World :: View topic - Jump List Data
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Jump List Data

 
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Technical Issues
View previous topic :: View next topic  
Author Message
londonb
Newbie
Newbie


Joined: Dec 30, 2015
Posts: 1

PostPosted: Thu Dec 31, 2015 5:48 am    Post subject: Jump List Data Reply with quote

Hi,

First question, so hello to everyone!

I have a question re jump list data. I am looking for whether a file has been viewed on a computer and intend to look at the jump lists. The prosecution are alleging there is a deleted jump list record which has the target file name.

Firstly, are deleted jump list records recoverable?
Secondly, for videos, would a timestamp be available?
Thirdly, in the case of a video, would a jumplist record prove that it was actually viewed? Is it possible the jump list record could have been created by another app or automatic process? I am thinking anti virus, movement to the recycle bin or anything else.
If not, I presume that it could only prove that the item was at some stage opened by an application and of course isn't conclusive evidence that a video had actually been viewed.

I appreciate all your help!

Thanks
Back to top
View user's profile
PreferredUser
Newbie
Newbie


Joined: Jan 01, 2007
Posts: 1130
Location: USA

PostPosted: Thu Dec 31, 2015 7:25 am    Post subject: Reply with quote

There is a lot of information available about Jump Lists, including this research paper: "http://www.champlain.edu/Documents/LCDI/Jump%20List%20Forensics.pdf" and a good article by Harlan Carvey "http://windowsir.blogspot.com/2011/12/jump-list-analysis.html". (There are plenty more, just DuckDuckGo, Google, or Bing, or whatever)

Perhaps those will help you understand what a Jump List indicates. (Pointing that out in an effort to correct your perception that a Jump List shows that something has been viewed rather than opened. How can you say something was viewed without an eyewitness? It is critical for even novice forensic examiners to use the precise (and correct) terminology.)
Back to top
View user's profile
Display posts from previous:   
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Technical Issues All times are GMT + 10 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB 2.0.10 © 2001 phpBB Group
phpBB port v2.1 based on Tom Nitzschner's phpbb2.0.6 upgraded to phpBB 2.0.4 standalone was developed and tested by:
ArtificialIntel, ChatServ, mikem,
sixonetonoffun and Paul Laudanski (aka Zhen-Xjell).

Version 2.1 by Nuke Cops 2003 http://www.nukecops.com

Forums ©

 

TMs property of their respective owner. Comments property of posters. 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted phpnuke.org (c)2003, and is free under licence agreement. All Rights Are Reserved.