Which artifact records recently opened files by a user?

• A. Jump lists
• B. Registry
• C. Event logs
• D. Prefetch

Answer: (A)

Jump Lists are the artifact that records recently opened files by a user. Windows builds a per-application list of items you’ve recently accessed, accessible through the Start menu or by right‑clicking a taskbar item. These lists are stored per user in dedicated locations and include file paths (and often timestamps) for documents you’ve opened, making them a direct trail of recent activity.

The other options don’t fit as neatly. The Registry can hold various user-specific MRU data, but it isn’t a single, reliable source for a complete list of recently opened files across all apps. Event logs capture events, and unless file‑access auditing is enabled, they won’t provide a clean history of recent documents. Prefetch tracks files used during program startup to speed launches, not a broad record of files opened by the user over time. Jump Lists are specifically designed to reflect recently opened files, making them the best fit.