CPY JMP
Brief
I’m teaching FOR500 Windows Forensic Analysis in Singapore this week and something that was recently added to the class relates to a new(ish) discovery into the operation of Jumplists on Windows 10.
During an update to the class it was discovered that when a folder is copied, the AutomaticDestination Jumplist file associated with Windows Explorer will track the folder copy operation as an interaction. How cool! Unfortunately this only relates to folder copies and not file copies but I’ll take it.
To demonstrate this I created a new folder, Folder to steal, at 2023-05-16 10:24 AM.
I then copied this to a different location, and never interacted with it otherwise.
We know that this historically did not create a jumplist entry, and one would be created if I went into the folder and created or opened a file, or created a folder.