Difference between revisions of "LNK"

From Forensics Wiki
Jump to: navigation, search
Line 15: Line 15:
  
 
* [http://mitec.cz/wfa.htm Free tool that is capable of reading on reporting on Windows shortcut files]
 
* [http://mitec.cz/wfa.htm Free tool that is capable of reading on reporting on Windows shortcut files]
Specific can be found here:
 
 
* [http://www.i2s-lab.com/Papers/The_Windows_Shortcut_File_Format.pdf Details of Windows shortcut file format]
 
* [http://www.i2s-lab.com/Papers/The_Windows_Shortcut_File_Format.pdf Details of Windows shortcut file format]
  
 
[[Category:File Formats]]
 
[[Category:File Formats]]

Revision as of 17:12, 27 September 2006

40px-Ambox warning pn.png

This article, and others, needs to be wikified.
Please remove this template after wikifying.

MS Windows Shortcut Files


In addition the target file, Windows shortcut files contain several interesting pieces of information that include:

  • Three date/time stamps that relate to the last time the target was accessed by the given shortcut file. (More testing needs to be done to determine exactly how these date/time stamps relate to the target.)
  • The size of the target when it was last accessed.
  • Serial number of the local volume where the target was stored.
  • Network volume share name
  • Read-only, hidden, system, volume label, encryption, sparse, compressed, offline and several other target attributes.

External Links