CHFI OS and Network Forensics Practice Question
During a forensic examination of a Windows 10 system, you find a file named "chrome_000001.jumplist" in the user's AppData directory. What does the presence of this file indicate?
⚠ Common exam trap
EC-Council CHFI often tests the misconception that jump lists are browser-specific data files (like bookmarks or extensions) rather than recognizing them as a Windows OS feature for tracking recent application usage, leading candidates to confuse them with Chrome's internal storage formats.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file stores recent items accessed through Chrome, such as downloaded files
Jump lists in Windows store recently accessed items for applications pinned to the taskbar or recently used. The file 'chrome_000001.jumplist' is a Windows-generated binary file that logs recent documents, downloads, or URLs opened via Google Chrome. Its presence indicates the user has recently accessed files or links through Chrome, making D correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file is a Chrome extension
Why it's wrong here
A .jumplist file records recent and pinned items for a Windows application's taskbar jump list, not a Chrome extension. It tempts because the filename contains 'chrome', but the extension is the .jumplist suffix. This artefact would be relevant when examining user activity for recently opened files.
- ✗
The user has installed Chrome via a jump list installer
Why it's wrong here
Jump lists are a Windows shell feature, not an installer; Chrome is installed via its own installer or package manager. It tempts because 'jump list' appears in the filename, but the artefact records application activity. This would be relevant when tracing how software was deployed.
- ✗
The file contains Chrome bookmarks
Why it's wrong here
Bookmarks are stored in Chrome's Bookmarks JSON file, not in a .jumplist, which records recent and pinned jump list entries. It tempts because both relate to browsing activity, but the format and purpose differ. This artefact would be relevant when reconstructing recently accessed items.
- ✓
The file stores recent items accessed through Chrome, such as downloaded files
Why this is correct
Chrome's jumplist files record recently accessed items surfaced through the taskbar jump list, including downloaded files and recent pages. Their presence evidences user activity tied to Chrome, providing forensic artefacts of accessed content rather than cache or credential data.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.