A forensic insight into Windows 10 Jump Lists

Singh, Bhim; Singh, Upasna

doi:10.1016/j.diin.2016.02.001

Cited by 18 publications

(14 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In doing so, it creates a prefetch file for each application that holds important forensic artifacts such as the total count of executions and the date/time of the last eight executions [13]. Other examples of OS functionalities and services that yield valuable artifacts are the AmCache [14], thumbcache files [15], JumpLists [16,17], Windows Search Indexer [18], Cortana digital assistant [19,20], and the system resource usage monitor (SRUM) [21], to name just a few. Singh and Singh give a broad overview of the forensic artifacts created whenever Windows OS executes an application [22].…”

Section: Related Workmentioning

confidence: 99%

Digital forensic artifacts of the Your Phone application in Windows 10

Domingues

Frade

Andrade

et al. 2019

Digital Investigation

View full text Add to dashboard Cite

Your Phone is a Microsoft system that comprises two applications: a smartphone app for Android 7+ smartphones and a desktop application for Windows 10/18.03+. It allows users to access their most recent smartphonestored photos/screenshots and send/receive short message service (SMS) and multimedia messaging service (MMS) within their Your Phone-linked Windows 10 personal computers. In this paper, we analyze the digital forensic artifacts created at Windows 10 personal computers whose users have the Your Phone system installed and activated. Our results show that besides the most recent 25 photos/screenshots and the content of the last 30-day of sent/received SMS/MMS, the contact database of the linked smartphone(s) is available in a accessible SQLite3 database kept at the Windows 10 system. This way, when the linked smartphone cannot be forensically analyzed, data gathered through the Your Phone artifacts may constitute a valuable digital forensic asset. Furthermore, to explore and export the main data of the Your Phone database as well as recoverable deleted data, a set of python scripts-Your Phone Analyzer (YPA)-is presented. YPA is available wrapped within an Autopsy module to assist digital practitioners to extract the main artifacts from the Your Phone system.

show abstract

Section: Related Workmentioning

confidence: 99%

Digital forensic artifacts of the Your Phone application in Windows 10

Domingues

Frade

Andrade

et al. 2019

Digital Investigation

View full text Add to dashboard Cite

show abstract

“…Recently, Jump Lists has been one of the most important forensic artifacts. The function of Jump Lists is firstly introduced by the release of Windows 7 and keeps the function in new Windows systems [1], but the format of Jump Lists of Windows 7/8 is different from that of Window 10. The same with many forensic artifacts, the purpose of Jump Lists is to provide users with increasing usability and convenience.…”

Section: Introductionmentioning

confidence: 99%

“…In the experiment of Antonovich [3], FTK, Encase and a Jump Lists parser (JumpLister [4]) cooperate to look at Jump Lists data. Owing to those characteristics which Jump Lists helps the investigation of digital forensics significantly, Jump Lists has got many discussions about how to access records of Jump Lists since Jump Lists was introduced [1] and many Jump Lists analysis tools have been developed [1][3]- [10]. Furthermore, Smith [11] identified the fraudulent documents by Windows 7 Jump Lists.…”

Section: Introductionmentioning

confidence: 99%

A Visualization Jump Lists tool for Digital Forensics of Windows

2020

KSII TIIS

View full text Add to dashboard Cite

In this paper, a visualization digital forensics tool, called JumpList Analyzer, is implemented. The tool can analyze the complicated Jump Lists files, and then the results are demonstrated by visualization. To compare the proposed tool with the other Jump Lists tools, the proposed tool is the only one can display the analyzed results by visualization. The visualization will help the investigators more easily to find the evidence than the other tools showing the analyzed results by texts only. In the experiment, the proposed JumpList Analyzer is demonstrated its convenience at identifying artifacts for doing digital forensics in a financial fraud case. In addition, the proposed tool can also be used to reveal the computer user's behavior or background.

show abstract

“…Singh & Singh (2016) have shown the traces of recently accessed files and run applications in Jump Lists on a Windows system. The authors demonstrated that the traces of run applications persist even after the applications are removed from the system.…”

Section: Introductionmentioning

confidence: 99%

Leveraging the Windows Amcache.hve File in Forensic Investigations

Singh¹,

Singh²

2016

JDFSL

Self Cite

View full text Add to dashboard Cite

The Amcache.hve is a registry hive file that is created by Microsoft ® Windows ® to store the information related to execution of programs. This paper highlights the evidential potential of Amcache.hve file and its application in the area of user activity analysis. The study uncovers numerous artifacts retained in Amcache.hve file when a user performs certain actions such as running host-based applications, installation of new applications, or running portable applications from external devices. The results of experiments demonstrate that Amcache.hve file stores intriguing artifacts related to applications such as timestamps of creation and last modification of any application; name, description, publisher name and version of applications; execution file path, SHA-1 hash of executable files etc. These artifacts are found to persist even after the applications have been deleted from the system. Further experiments were conducted to evaluate forensic usefulness of the information stored in Amcache.hve and it was found that Amcache.hve information is propitious to trace the deleted applications, malware programs and applications run from external devices. Finally, comparison of information in Amcache.hve file with information in other similar sources (IconCache.db, SRUDB.dat and Prefetch files) is shown, in order to provide more useful information to forensic investigators.

show abstract

A forensic insight into Windows 10 Jump Lists

Cited by 18 publications

References 2 publications

Digital forensic artifacts of the Your Phone application in Windows 10

Digital forensic artifacts of the Your Phone application in Windows 10

A Visualization Jump Lists tool for Digital Forensics of Windows

Leveraging the Windows Amcache.hve File in Forensic Investigations

Contact Info

Product

Resources

About