Jump Lists

Posted my Jump List parser code
http//code.google.com/p/winforensicaanalysis/downloads/list

Harlan, good post. Yes, I have used it as evidence and routinely check for it on every case. It is the best indication of a file being opened by a particular application at a particular time.

I also read on another whitepaper some time back that in older versions of firefox (might work now too), when in private mode browsing, files downloaded are also found in jumplists.

Yogesh,

If you can find that white paper, I'd greatly appreciate it…

I think he's referring to the whitepaper by Alex Barnett (Yogesh, please correct me if I'm wrong). The paper mentions that downloaded files using the private browsing mode of FireFox 3.6.16 appeared in a Firefox jump list. It'd be interesting to see if this issue is still there…

I'll have to see if I can't replicate that within a VM…thanks for pointing that out.

I think he's referring to the whitepaper by Alex Barnett (Yogesh, please correct me if I'm wrong). The paper mentions that downloaded files using the private browsing mode of FireFox 3.6.16 appeared in a Firefox jump list. It'd be interesting to see if this issue is still there…

Yes that and another one that was on browser private mode artifacts (cant find it now) mentioned it.

I set up a Win7 VM last night, installed FF 9.x, set it to private browsing mode and then downloaded some files. I'll try to see if I can get some time tonight to determine if these files are recorded in any way in Jump Lists.

<edit>I have done a good amount of review of the papers and information out there on private browsing modes. I have not come across anything about JumpLists. Private Browsing mode in IE and FF are generally very good about not leaving tracks. In IE for example </edit>

With IE 8, the feature of “InPrivate Browsing” is an option to allow users to
activate a “mode” that will not keep any trace of browsing activity. From the Microsoft MSDN Internet Explorer blog article

While InPrivate Browsing is active, the following takes place
• New cookies are not stored
o All new cookies become “session” cookies
o Existing cookies can still be read
o The new DOM storage feature behaves the same way
• New history entries will not be recorded
• New temporary Internet files will be deleted after the Private Browsing window is closed
• Form data is not stored
• Passwords are not stored
• Addresses typed into the address bar are not stored
• Queries entered into the search box are not stored
• Visited links will not be stored

One of the white papers that I have found useful that might have been the reference paper referred to is "An Analysis of Private Browsing Modes in Modern Browsers"
http//crypto.stanford.edu/~dabo/pubs/abstracts/privatebrowsing.html
<edit>However it does not mention JumpLists but has information about the artifacting from downloads.</edit>

Doug,

Any thoughts on how this information might affect Jump Lists? I downloaded the paper and used the built-in (within Adobe) search functionality, and didn't find any reference to "Jump List".

Not specifically to JumLists but in relation to the artifacts left with the downloads. (Sorry cleaned up prior post so at least it was less confusing as to why I posted it). From that paper and the other research I have done recently on private browser modes I have not found that JumpList artifacts were cited or referenced at all. Though from looking at the white papers and blogs I have as references all the test scenarios seem to be with XP. Not sure what paper Yogesh was referencing too but would love to see it as well.

As listed prior and in the paper, the private browsing mode seems to be very specific about not leaving a lot of OS artifacts and wondering if the JumpLists would occur for the "Downloads" window that appears as part of the integrated download manager in FF when a user doubleclicks on an item in the list. Just thought the backgrounder of PBM could be useful in context to the discussion of the artifacts that can be found. I have had a Win 7 VM set-up for PBM testing and will try to take a look to see if there is a tie in.