← DFIR

Jump Lists Forensics 2025

Cyber Triage guide to Windows Jump Lists as forensic evidence.

Explains how Jump Lists record recently and frequently opened files per application, where they live on disk, how to parse them and what they prove about user activity. Good for building a timeline of file access.

Why it's useful

Shows which files a user touched and from which app.