Owing to those characteristics which Jump Lists helps the investigation of digital forensics significantly, Jump Lists has got many discussions about how to access records of Jump Lists since Jump Lists was introduced and many Jump Lists analysis tools have been developed. In the experiment of Antonovich, FTK, Encase and a Jump Lists parser (JumpLister ) cooperate to look at Jump Lists data. However, the commercial digital forensics tools, for example the famous forensics tools, FTK and Encase, have not incorporated the records of Jump Lists into their functions. Even the files and applications that a user ever used are deleted the artificial records are kept in Jump Lists. For investigators, they can take advantages of this service and gather critical insight into the user’s computer habits, knowledge and activities. By the analysis of Jump Lists, the investigators can reveal the evidences of digital forensics. The records of Jump Lists are related to the MRU (Most Recently Used) and MFU (Most Frequently Used) items, file name with path, the timestamps of MAC (Modified, Accessed, and Created), disk volume name, and the history of uploading and downloading files by web browsers. However, Jump Lists provides more records include MRU and MFU. The way of Jump Lists maintaining the records of recently accessed files and folders is to group the records as files according to every application.īefore Jump Lists introduced, if an investigator of digital forensics would like to track a suspect’s history in using applications, the only way is to access the list of the Most Recently Used (MRU) and the Most Frequently Used (MFU) in Windows registry. Since that Jump Lists is built by software applications or Windows operating system and let the users be able to “jump” to the recently accessed files and folders, it is called “Jump Lists”. The same with many forensic artifacts, the purpose of Jump Lists is to provide users with increasing usability and convenience. The function of Jump Lists is firstly introduced by the release of Windows 7 and keeps the function in new Windows systems, but the format of Jump Lists of Windows 7/8 is different from that of Window 10. Recently, Jump Lists has been one of the most important forensic artifacts.
0 kommentar(er)
