Using jump lists to identify fraudulent documents

Jump lists show the file opening activity of a computer user. When a computer user wants to know the most recent file they opened, a jump list can provide that information. Windows 7 displays jump lists for recently used files, but more importantly for investigators, it also records hidden jump list artifacts. These hidden jump list artifacts reveal the complete trail a fraudster follows in creating fraudulent documents or to perform other illegal activities when using their computers. Such jump list artifacts can remain on the computer's drives for years. The paper describes a method that can be used to identify artifacts and their potential for use as forensic evidence in a financial fraud case.