Where can you find information about application execution?

• A. Jump lists
• B. Event logs
• C. Registry
• D. Prefetch

Answer: (A)

Jump Lists capture evidence of how a program was used by listing the recent documents and tasks associated with that application. This makes them a direct indicator of application execution and user actions tied to that program. On Windows, these lists are stored per user and include references to files opened or tasks launched by the app, along with timestamps when those items were accessed. In a forensic or audit context, examining Jump Lists helps establish that the application was run and what it did during that session, which files were involved and what actions were performed.

Event logs can show that an application started or encountered events, but they’re a broader record of many system and software activities and don’t always provide the concise, user-action–driven run history that Jump Lists offer. The Registry holds configuration data and startup keys, not a direct execution history. Prefetch records program startup to speed up loading and can indicate that an executable ran, but Jump Lists give a more explicit trail of recent application usage and related items.