What is a jump list? The answer depends on who you are. For general users, they’re a way to access recently used files. For investigators, they’re a means to understand user behavior.
But no matter who you are, this definitive guide will help you use jump lists for what you need.
Jump to…
What Is a Jump List?
What Is Jump List Cache?
When Jump Lists Can Miss Data
How to Enable Jump Lists
How to Disable Jump Lists
How to Add Items to a Jump List
What Programs Use Jump Lists?
Recommended Resources
What Is a Jump List?
A jump list provides quick access to files, folders, and application-specific tasks used recently or frequently. It’s a Windows feature introduced in Windows 7 to improve productivity by streamlining access to frequently used resources. You can view a jump list for a given app through the Taskbar, Start menu, or keyboard shortcuts.
| How to Access Jump Lists. | ||
|---|---|---|
 Right-click the app icon in the taskbar to view the taskbar jump list. |
 Look for the app in the Start menu. To view the jump list, right-click or hover over it. |
 Use Win + Alt + [Taskbar Number] to view the Taskbar app’s jump list. |
| What Jump Lists Show. | ||
|---|---|---|
 |
 |
 |
|
Jump Lists show recent or pinned items and shortcuts to common actions. |
||
Digital investigators analyze the user activity — including files accessed and timestamps — contained in jump lists.
 |
 |
This helps investigators build a digital timeline of files, folders, and websites a user has accessed over time.
We do not recommend investigators focus on memorizing the differences among jump lists, Prefetch, MUICache, and other “Data Artifacts.” There are many types, and they get confusing. Instead, we suggest focusing on higher-level computing concepts during investigations. DFIR expert Brian Carrier: “You don’t care about jump lists. What you really want to know is what users have accessed what resources at what time. This is a higher-level concept that cuts across multiple Data Artifact types. This is about all the ‘Data Accessed.’” To learn more about a modern approach to analyzing jump lists, read “Jump List Forensics 2025.”
Cyber Triage is investigation software built to handle the details of data artifacts — like jump lists — for investigators. It collects and automatically analyzes the data, and presents it to investigators according to how suspicious it is. It’s a really cool ranking system we call “artifact scoring.”
So… what is jump list? Honestly, you don’t have to worry about that with Cyber Triage.
What Is Jump List Cache?
A jump list cache is the user activity data that populates the jump list menu. The cache stores data such as files accessed recently, file access timestamps, file access count, and applications that accessed files. To learn more about the technical details of jump lists, read “What Is Jump List Cache?”
When Jump Lists Can Miss Data
Jump list can provide a wealth of information to investigators, but it’s important to understand its limitations. There are a handful of scenarios that one should be aware of. Just because you do not see jumplist data does not mean a file was not accessed using a particular app. That is why it is crucial to look at multiple data artifacts to get a more complete picture of what occurred on a system instead of relying on a single artifact source.
Scenarios where jump list data may be missing:
| Scenario | Notes |
|---|---|
| App Does Not Record Jump list Data. | 7zip and notepad++ are examples of apps that don’t show jumplist data. |
| App Records Data but It Was Deleted. | Files could have been manually deleted. |
| App Records Data but Setting Is Disabled. | While the system setting that allows jumplists to operate is disabled, new data will not be recorded. However, it’s important to note that old data will still exist. See the sections below on how to enable/disable jumplists. |
| App Not Registered to Handle File Type. | This means the file type will not show up in the jumplist data. For example, LibreOffice will not record a file being opened in the jumplist if it has no extension or has a .exe extension — even if it’s just a text file. |
How to Enable Jump Lists
Follow these steps:
#1. Open Settings:
Press Windows + I to open the Settings app.
#2. Go to Personalization:
Select “Personalization” from the menu.
#3. Navigate to Start:
In the left-hand menu, select “Start”.
#4. Enable Recent Items:
Toggle on “Show recently opened items in Jump Lists on Start or the Taskbar”.
Now just lists will display recent and frequent items for supported apps.
How to Disable Jump Lists
To disable jump lists in Windows, repeat steps 1-3 above, then:
Toggle off “Show recently opened items in Jump Lists on Start or the taskbar.”
This will prevent jump lists from displaying recently opened items, and all existing entries will be cleared.
How to Remove Jump Lists for an App
Follow these steps (on Windows 10):
#1 Find the app’s jump list:
Navigate to the applications jump list menu — either via the Taskbar or Start menu.
#2a Remove Individual Items:
Hover over an item in the list, then click the small “X” next to it to remove it from the jump list.
#2b Clear the Entire Jump List:
You can clear all jump lists by disabling and re-enabling them:
- Go to Settings > Personalization > Start.
- Toggle off “Show recently opened items in Jump Lists on Start or the taskbar.”
This clears all jump lists. Toggle it back on if you want jump lists to work for other apps.
Now the files associated with a specific app are no longer visible in the jump list.
While both methods described above will clear the jump list seen in the Windows interface, they will not clear out the actual jump list data in the cache. This means forensic analysis can still remove data.
How to Add Items to a Jump List
Follow these steps (on Windows 10):
#1 Open the App.
Launch the application associated with the Jump List (e.g., Word, Excel, or a browser).
#2 Open the Item:
Access the file, folder, or task you want in the Jump List. This adds it to the Recent Items section of the list.
#3 Pin the Item:
Right-click the app icon on the Taskbar to open its Jump List. Find the item under Recent or Frequent and click the pin icon next to it. The item is now in the Pinned section.
Once pinned, the item will stay in the Jump List until you unpin it, even if it’s no longer frequently used.
What Programs Use Jump Lists?
All Windows apps can use jumplists, but not all do.
Here are:
- Categories of apps that use jump lists
- Examples of data they contain
- Digital forensic relevance
Web Browsers
Microsoft Edge, Google Chrome, Mozilla Firefox.
- Jump List Content:
- Frequently or recently visited websites
- Tasks like “New Tab” or “Incognito Mode”
- Pinned tabs
- Digital Forensic Relevance:
- Able to see frequently visited websites to establish browsing pattern.
- Able to see recently closed tabs to understand what users were recently viewing.
Office and Productivity Applications
Microsoft Word, Excel, PowerPoint, Notepad.
- Jump List Content:
- Recent documents
- Frequently used files
- Pinned projects for quick access
- Digital Forensic Relevance:
- Recently accessed documents can provide insight into what users recently had access to
- Frequently accessed documents show files that are normally accessed by the user. This could be interesting to know in some cases and less interesting in others
Media Players
Windows Media Player, VLC, Spotify.
- Jump List Content:
- Recently played media
- Frequently used playlists
- Shortcuts to playback controls
- Digital Forensic Relevance:
- Can have significant value when it comes to child exploitation cases or internal HR investigations for evidence of employees not doing their job
File Management Tools
File Explorer, WinRAR.
- Jump List Content:
- Common file management actions like “New Folder”
- frequently/Recently accessed folders
- Pinned directories
- Digital Forensic Relevance:
- WinRAR recently accessed zip files can provide insight into phishing cases as well as data exfil
- Frequently listed dirs in File Explorer can provide insight into users’ routine behavior
Remote Access Software
Remote Desktop.
- Jump List Content:
- Recent remote hosts
- Pinned remote hosts
- Digital Forensic Relevance:
- Jumplist data for recently accessed remote hosts can be extremely valuable. It’s important to know what systems a user has recently accessed for many scenarios such as: Ransomware, data exfil, and insider threat
Recommended Resources
From “What is a jump list?” to “What programs use jump lists?” we hope we’ve covered your fundamental questions about this Windows feature. If you still have questions, we recommend the following resources:
| General Use | Investigators |
|---|---|
