Create an account Home  ·  Topics  ·  Downloads  ·  Your Account  ·  Submit News  ·  Top 10  
· Home
· Content
· Forensic Downloads
· Forensics Feedback
· Forums
· Members List
· Statistics
· Surveys
· Top 10
· Topics
· Training Reviews
· Web Links
· Your Account

Our Membership

Latest: Esearchadvisors
New Today: 1
New Yesterday: 3
Overall: 29512

Computer Forensics
This is a free and open peer to peer medium for digital and computer forensics professionals and students. Please help us maintain it by contributing and perhaps linking to us from your own website.

Recent Posts

 Some Tips to Snap 6% off runescape gold from Rsorder for Gem
 is it possible to verify if a HDD was wiped with DBAN
 Forenic artifacts if someone accessed a remote Win10?
 timeline analysis
 Hostile work enviornment

Computer Forensics World Forums

Pages Served
We received
page views since August 2004

Security Sources

OnGuard Online
ISO 17799 ISO 27001
ISO 27000 Toolkit
ISO 27001 & 27000
Security Policies

Computer Forensics World: Forums

Computer Forensics World :: View topic - Jump List Data
 Forum FAQForum FAQ   SearchSearch   UsergroupsUsergroups   ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 

Jump List Data

Post new topic   Reply to topic    Computer Forensics World Forum Index -> Technical Issues
View previous topic :: View next topic  
Author Message

Joined: Dec 30, 2015
Posts: 1

PostPosted: Thu Dec 31, 2015 5:48 am    Post subject: Jump List Data Reply with quote


First question, so hello to everyone!

I have a question re jump list data. I am looking for whether a file has been viewed on a computer and intend to look at the jump lists. The prosecution are alleging there is a deleted jump list record which has the target file name.

Firstly, are deleted jump list records recoverable?
Secondly, for videos, would a timestamp be available?
Thirdly, in the case of a video, would a jumplist record prove that it was actually viewed? Is it possible the jump list record could have been created by another app or automatic process? I am thinking anti virus, movement to the recycle bin or anything else.
If not, I presume that it could only prove that the item was at some stage opened by an application and of course isn't conclusive evidence that a video had actually been viewed.

I appreciate all your help!

Back to top
View user's profile

Joined: Jan 01, 2007
Posts: 1130
Location: USA

PostPosted: Thu Dec 31, 2015 7:25 am    Post subject: Reply with quote

There is a lot of information available about Jump Lists, including this research paper: "" and a good article by Harlan Carvey "". (There are plenty more, just DuckDuckGo, Google, or Bing, or whatever)

Perhaps those will help you understand what a Jump List indicates. (Pointing that out in an effort to correct your perception that a Jump List shows that something has been viewed rather than opened. How can you say something was viewed without an eyewitness? It is critical for even novice forensic examiners to use the precise (and correct) terminology.)
Back to top
View user's profile
Display posts from previous:   
Post new topic   Reply to topic    Computer Forensics World Forum Index -> Technical Issues All times are GMT + 10 Hours
Page 1 of 1

Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum

Powered by phpBB 2.0.10 © 2001 phpBB Group
phpBB port v2.1 based on Tom Nitzschner's phpbb2.0.6 upgraded to phpBB 2.0.4 standalone was developed and tested by:
ArtificialIntel, ChatServ, mikem,
sixonetonoffun and Paul Laudanski (aka Zhen-Xjell).

Version 2.1 by Nuke Cops 2003

Forums ©


TMs property of their respective owner. Comments property of posters. 2007 Computer Forensics Science World.
Digital forensic computing news syndication: Computer Forensics Training News or UM Text
Software is copyrighted (c)2003, and is free under licence agreement. All Rights Are Reserved.