Jump List Data


londonb

New Member
Dec 29, 2015
3
0
#1
Hi,

First question, so hello to everyone!

I have a question re jump list data. I am looking for whether a file has been viewed on a computer and intend to look at the jump lists. The prosecution are alleging there is a deleted jump list record which has the target file name.

Firstly, are deleted jump list records recoverable?
Secondly, for videos, would a timestamp be available?
Thirdly, in the case of a video, would a jumplist record prove that it was actually viewed? Is it possible the jump list record could have been created by another app or automatic process? I am thinking anti virus, movement to the recycle bin or anything else.
If not, I presume that it could only prove that the item was at some stage opened by an application and of course isn't conclusive evidence that a video had actually been viewed.

I appreciate all your help!

Thanks
 
Dec 31, 2006
3,405
0
#2
There is a lot of information available about Jump Lists, including this research paper: "http://www.champlain.edu/Documents/LCDI/Jump%20List%20Forensics.pdf" and a good article by Harlan Carvey "http://windowsir.blogspot.com/2011/12/jump-list-analysis.html". (There are plenty more, just DuckDuckGo, Google, or Bing, or whatever)

Perhaps those will help you understand what a Jump List indicates. (Pointing that out in an effort to correct your perception that a Jump List shows that something has been viewed rather than opened. How can you say something was viewed without an eyewitness? It is critical for even novice forensic examiners to use the precise (and correct) terminology.)
 

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu