Jump List Cache is a Windows artefact that stores a user’s recent and pinned files, folders, and application activity for the taskbar Jump List feature. It is kept in user profile data and can reveal document paths, program usage and other activity history, so analysts often treat it as a useful forensic trace.
What the Jump List Cache records
The Jump List Cache is a Windows user-profile artefact that preserves recent and pinned items from the taskbar Jump List feature. Because it can retain file paths, program references, and activity history, it often provides a compact view of what a user recently touched on the endpoint.
Forensic value comes from the fact that the cache reflects user interaction rather than just installed software. In incident response, that makes it useful for reconstructing file access, application launching, and likely working directories when other traces are incomplete or have already aged out.
Where it lives and why investigators care
This artefact sits in the user context, so its contents are tied to a specific profile rather than the whole machine. That matters because one workstation can contain several distinct user histories, and the cache can help separate one user’s activity from another’s on the same endpoint.
The cache is also useful when timeline reconstruction needs corroboration. It can support what analysts see in recent file activity, shell item traces, link files, or execution artefacts, especially when they are trying to determine whether a document, folder, or application was merely present or actually used.
Because Jump List data is application-aware, it can surface how a user interacted with software in a way that generic filesystem inspection may not. That makes it a practical artefact for triage, scoping, and hypothesis testing during Windows investigations.
What can be inferred from the cache
A populated cache may reveal document names, directory paths, application names, and usage patterns that are otherwise hard to see quickly. Those details can help an analyst infer recent workstreams, staging locations, and which applications were active around a suspected event.
It can also expose contextual clues about a user’s routine, such as repeated access to the same files or folders, which can be important when comparing normal behaviour with suspicious activity. The value is often in the pattern, not any single entry.
The artefact is not a full history of everything a user did, and it should be interpreted alongside creation times, other execution artefacts, and the surrounding timeline. On its own, it is indicative; in combination, it can become highly probative.
How to use it without overreading it
Analysts should treat Jump List Cache output as one line of evidence in a broader Windows artefact review. The most reliable interpretations usually come from cross-checking it against host timelines, document metadata, shortcut artefacts, and logs that confirm when and how an item was accessed.
Windows Forensic Artefacts Guide is a useful companion when you are correlating Jump List evidence with related Windows traces such as registry hives, event logs, ShellBags, and other artefacts that help confirm user activity.
The practical rule is simple: use the cache to narrow questions, then validate those questions with independent evidence before drawing conclusions about access, intent, or sequence.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | AU-6 — Audit Review, Analysis, and Reporting | Jump List Cache supports endpoint activity reconstruction and audit-style review of user actions. |
| AU-11 — Audit Record Retention | The artefact's evidentiary value depends on retaining traces long enough for investigation. | |
| Recommendation — Correlate Jump List entries with host logs and other artefacts to reconstruct user activity. Preserve endpoint artefacts and related logs long enough to support later forensic review. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Investigations rely on collecting and protecting endpoint traces that record user activity. |
| Recommendation — Centralise and protect endpoint artefacts and logs so activity evidence remains available for analysis. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 29, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org