File and folder accesswindowsPro
Jump Lists
Windows keeps a per-application record of the files each program opened, so the taskbar can offer them again. It is file access evidence with the application attached, which is more than most artifacts give you.
What members see here
- Every path this artifact lives at, and which builds each applies to.
- What it proves, and what it does not prove, which is the part that matters.
- How to parse it, and the tooling that reads it correctly.
- Hunting queries for Splunk, Sentinel and Elastic, with their false-positive notes.