#WINDOWS 7 FILE STRUCTURE WINDOWS 7#

1, it is also possible for a user to вЂpinвЂ™ items in order to retain them on a list. 1 вЂ“ Example of Jump List associated with Microsoft Paint.ДЄs indicated in Fig. An example of that interface is shown at Fig. The Jump List feature provides the user with a graphical interface associated with each installed application which lists files that have been previously accessed by that application. The article focuses primarily on artefacts relating to file accesses and although additional Jump List data relating to the use of individual programs has no focus in this paper, some work in this area has been conducted by Barnett (undated). The content of this article is based upon an MSc Thesis submitted by the author to Cranfield University in February 2012 but has been supplemented with observations and findings from analysis of Jump List files in actual investigations. This paper explores the type and level of information recorded by the Jump List feature, the structure of those records and the user actions which result in them being updated.

#WINDOWS 7 FILE STRUCTURE WINDOWS 7#

The records maintained by the feature have the potential to provide the forensic computing examiner with a rich source of evidence during examinations of computers running the Microsoft Windows 7 Operating System. The release of Microsoft Windows 7 introduced a new feature known as Jump Lists which present the user with links to recently accessed files grouped on a per application basis.

Forensic Analysis of Windows 7 Jump Lists

Windows 7 file structure