Jump List Changes in Windows 10 & 11: What You Need to Know

Jump Lists have undergone significant changes in Windows 10 and 11, just like LNK shell items. These changes have expanded the range of recorded data, making Jump Lists even more valuable for forensic analysis. While some changes may seem subtle, they provide deeper insights into user activities.

-----------------------------------------------------------------------------------------------------

1. Quick Access and Its Role in Jump Lists

What is Quick Access?

Quick Access is a Windows File Explorer feature introduced in Windows 10 that allows users to quickly find recently opened files and folders. It also lets users pin frequently used items for easy access.

How is Quick Access stored?

• Quick Access data is saved in a dedicated Jump List.

• This is usually one of the largest Jump Lists on a system because it records multiple file types and locations.

• It provides a broad view of recently accessed items.

Limitations:

• Quick Access does not always record every opened file.

• Some files may not have LNK (shortcut) information in this list.

💡 Best Practice: 

Since Quick Access doesn’t capture everything, always cross-reference it with application-specific Jump Lists (e.g., Jump Lists from Microsoft Word, Adobe Reader, or other software).

-----------------------------------------------------------------------------------------------------

2. Tracking Newly Created Files vs. Opened Files

Windows 10 and 11 have changed how files appear in Jump Lists when they are created or saved to a different location (e.g., using "Save As").

Key Differences:

• Previously: Jump Lists mainly recorded files that were opened.

• Now: Jump Lists also capture files when they are newly created in a different location.

How to Determine If a File Was Created or Just Opened:

• When a file is newly created, it appears in both Quick Access and the dedicated application Jump List (but not for all file types).

  
  

• You can compare timestamps:

  • If the ****target creation timestamp matches the DestList last modified timestamp**, the file was likely newly created.

  • If the timestamps do not match, the file was simply opened rather than created.

-----------------------------------------------------------------------------------------------------

3. Tracking Folder Copying with Jump Lists

One of the most important updates in Windows 10 & 11 is that Jump Lists now track folder copying.

What Does This Mean?

• When a user copies a folder, Windows creates an entry in the File Explorer Jump List.

• This applies to both single and multiple folder copies.

• Mounted drives and external storage devices are also tracked.

Why Is This Important?

• If a user copies a folder to a USB drive, Windows records:

  • The copied folder's name

  • The destination location

  • The time the folder was copied (based on the target creation timestamp)

💡 Forensic Insight: 

Just like file creation tracking, matching the target creation timestamp with the DestList last modified timestamp helps determine if the folder was simply opened or copied to another location.

-----------------------------------------------------------------------------------------------------

4. Tracking Taskbar Search Activity in Microsoft Edge

Another notable update is that Jump Lists now record searches made from the Windows taskbar—specifically in Microsoft Edge’s Jump List.

How Does This Work?

• When a user performs a search in the taskbar and clicks the "Best Match" result, the search is recorded.

• These entries reference "Microsoft.Windows.Cortana", linking them to taskbar search results.

• The URL parameters in the entry contain the searched term.

• The entry’s last modified time logs the exact time the search was performed.

💡 Forensic Tip: 

By analyzing Jump Lists, investigators can see what the user searched for and when—even if browser history has been deleted!

-----------------------------------------------------------------------------------------------------

Final Thoughts

Jump Lists in Windows 10 and 11 offer more data than ever before, making them a powerful forensic artifact. These changes allow us to track:

✅ Recently accessed files and folders

✅ Files created or saved to a different location

✅ Copied folders, including external USB drives

✅ User search activity in Windows Taskbar and Microsoft Edge

To get the most accurate results, always cross-check Jump Lists with other forensic artifacts like LNK files, event logs, and shell bags. By doing so, you can build a clearer picture of user activity on a system.

Stay tuned for more deep dives into Windows forensic artifacts! 🚀

--------------------------------------------------Dean------------------------------------------