Thanks for the contribution guys/gals!
I think you are trying to find evidence about copying a document to usb device from jumplist if jumplisted file exist in acquired hard drive and jumplist indicate it as openned from usb drive yes you can say it you sould also look at link files to verify
jumplists are just collections of lnk files. if you have an automatic destination jump list there is a bit more info available over stuff from a custom jump list.
if you want to read about the inner workings of jump lists and get some more free tools for jump lists, start here
https://
this is a nice jump list gui i am working on too if you want to try it
https://
another thing to consider is looking at the full path to the document based on the jump list, then look at the shell bags via shell bags explorer to see what the parent directory(ies) look like for the document in question. you can then start drilling down into file system artifacts and volume serial numbers using the data in the relevant lnk file (and also creation date, droid birth info, etc). along with mft info from the lnk information and shell bag stuff.
lots to look at! =)


