LNKFile
Last updated
Last updated
Windows DFIR notes are no longer maintained on InfoSec-Notes. Updated versions can be found on: .
Location:
Automatically created shortcut files:
%SystemDrive%:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Recent\*.lnk
Additional likely locations of shortcut files:
Automatically created for documents opened using Microsoft Office products:
%SystemDrive%:\Users\<USERNAME>\AppData\Roaming\Microsoft\Office\Recent\*.lnk
On the users' Desktop:
%SystemDrive%:\Users\<USERNAME>\Desktop
in the Startup folders:
%SystemDrive%:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
%SystemDrive%:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
Yield information related to files and folders access.
Shortcut files (*.lnk) are Windows Shell Items that reference to an original file, folder, or application. The effect of double-clicking a shortcut file is intended to be the same as double-clicking the application or file to which it refers. In addition, command line parameters and the folder in which the target should be opened can be specified in the shortcut. The shortcut files have a magic number of 0x4C (4C 00 00 00).
While shortcut files can be created manually, the Windows operating system also creates shortcut files under numerous user activities, such as opening of a non-executable file. For instance, a shortcut file is created under [...]\AppData\Roaming\Microsoft\Windows\Recent\ whenever a file is opened from the Windows Explorer. Shortcut files created in such circumstances are referenced in the NTUSER.DAT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs registry keys.
The shortcut files format is also used for entries within the AutomaticDestinations and CustomDestinations JumpLists files (introduced in Windows 7). For more information on the JumpLists files, refer to the [DFIR] Windows - Artefacts - Jumplist note.
As the shortcut files are not automatically deleted if the target file is deleted, they can be a source of historical information.
The shortcut files yield the following information of forensic interest:
the target file's absolute path, size and attributes (hidden, read-only, etc.). The size and attributes are updated at each access to the target file (that induce an update to the shortcut file).
the target file and the shortcut file (source) itself Modified, Access, and Created (MAC) timestamps at the time of the last access to the target file.
whether the target file was stored locally or on a remote network share through the specification of a LocalPath or NetworkPath.
occasionally information on the volume that stored the target file: drive type (fixed vs removable storage media), serial number, and label / name if any.
occasionally information on the host on which the shortcut file is present: system's NetBIOS hostname and MAC address.
The source timestamps stored in the shortcut file, as well as the Creation and Modification timestamps of the shortcut file itself, will also usually respectively indicate when the target file was first and last opened.
Eric Zimmerman's LECmd.exe tool (KAPE's LECmd module) can be used to process shortcut files.
https://www.youtube.com/watch?v=wu4-nREmzGM https://forensicswiki.xyz/page/LNK https://www.magnetforensics.com/blog/forensic-analysis-of-lnk-files/#:~:text=LNK%20files%20are%20a%20relatively,LNK%20extension