Comparing LNK File and Jump List Artifacts on Windows 11 with those on Windows 10

LNK files and Jump Lists often serve as critical artifacts in the forensic investigation of a digital crime that involves a modern Windows computer. Prior research reported on the availability of these artifacts on an older version of Windows OS (Windows 10). However, to our knowledge, there is no study yet on the nature of these artifacts on the current version of Windows OS (Windows 11). To fill in this knowledge gap, we run extensive experiments on Windows 11, involving a variety of user activities that potentially result creation of LNK files and Jump Lists. We report a comparative analysis of these artifacts on Windows 11 with those on Windows 10.