Jump lists provide evidence of which user activity?

• A. Recently opened files
• B. Network connections
• C. Active directory changes
• D. Security policy updates

Answer: (A)

Jump lists capture recently opened files and items for applications, especially those pinned to the taskbar or Start menu. They provide evidence of user activity because each entry records the file name and location of a document that was opened through a program, often with a timestamp showing when it was accessed. In Windows, these artifacts live in the user profile (AutomaticDestinations and CustomDestinations) and can be examined to reconstruct which files a user interacted with and when. They don’t reflect network connections, Active Directory changes, or security policy updates, which are logged in other system logs. Keep in mind Jump Lists can be cleared or altered, so they are best used alongside other sources.