Difference between revisions of "LNK"

From ForensicsWiki
Jump to: navigation, search
m
Line 3: Line 3:
 
MS Windows Shortcut Files
 
MS Windows Shortcut Files
  
 +
== File Format ==
  
In addition the target file, Windows shortcut files contain several interesting pieces of information that include:
+
* TODO
 +
 
 +
== Metadata ==
  
 
* Three date/time stamps that relate to the last time the target was accessed by the given shortcut file.  (More testing needs to be done to determine exactly how these date/time stamps relate to the target.)
 
* Three date/time stamps that relate to the last time the target was accessed by the given shortcut file.  (More testing needs to be done to determine exactly how these date/time stamps relate to the target.)
Line 11: Line 14:
 
* Network volume share name
 
* Network volume share name
 
* Read-only, hidden, system, volume label, encryption, sparse, compressed, offline and several other target attributes.
 
* Read-only, hidden, system, volume label, encryption, sparse, compressed, offline and several other target attributes.
 
== File Format ==
 
 
 
* TODO
 
* TODO
  

Revision as of 18:15, 27 September 2006

40px-Ambox warning pn.png

This article, and others, needs to be wikified.
Please remove this template after wikifying.

MS Windows Shortcut Files

File Format

  • TODO

Metadata

  • Three date/time stamps that relate to the last time the target was accessed by the given shortcut file. (More testing needs to be done to determine exactly how these date/time stamps relate to the target.)
  • The size of the target when it was last accessed.
  • Serial number of the local volume where the target was stored.
  • Network volume share name
  • Read-only, hidden, system, volume label, encryption, sparse, compressed, offline and several other target attributes.
  • TODO

External Links