What Windows artifact provides direct evidence of specific files opened by a user?

• A. Jump lists
• B. Event logs
• C. Registry
• D. Shortcuts

Answer: (A)

Jump lists are the Windows artifact that provides direct evidence of specific files opened by a user. When you open a document through a supported application, that item often appears in the app’s jump list, showing the exact file name, path, and a timestamp of when it was accessed. This creates a concrete record of user activity—directly linking the user to particular files they opened.

Other artifacts work differently. Event logs can capture related actions if auditing is enabled, but they’re general logs of events and may not reliably enumerate every opened file. The registry stores settings and pointers, not a reliable record of opened documents. Shortcuts point to files but don’t prove the files were actually opened. Remember also that jump lists can be cleared or disabled by privacy settings, so their presence isn’t guaranteed in every case, but when they exist they give precise evidence of opened files.