ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Difference between revisions of "LNK"

From ForensicsWiki
Jump to: navigation, search
 
Line 9: Line 9:
 
* Read-only, hidden, system, volume label, encryption, sparse, compressed, offline and several other target attributes.
 
* Read-only, hidden, system, volume label, encryption, sparse, compressed, offline and several other target attributes.
  
 +
 +
Specific details of .lnk shortcut files can be found here:
 
[http://www.i2s-lab.com/Papers/The_Windows_Shortcut_File_Format.pdf Windows Shortcut File Format]
 
[http://www.i2s-lab.com/Papers/The_Windows_Shortcut_File_Format.pdf Windows Shortcut File Format]

Revision as of 19:24, 13 March 2006

MS Windows Shortcut Files

In addition the target file, Windows shortcut files contain several interesting pieces of information that include:

  • Three date/time stamps that relate to the last time the target was accessed by the given shortcut file. (More testing needs to be done to determine exactly how these date/time stamps relate to the target.)
  • The size of the target when it was last accessed.
  • Serial number of the local volume where the target was stored.
  • Network volume share name
  • Read-only, hidden, system, volume label, encryption, sparse, compressed, offline and several other target attributes.


Specific details of .lnk shortcut files can be found here: Windows Shortcut File Format