Difference between revisions of "LNK"

From ForensicsWiki
Jump to: navigation, search
Line 17: Line 17:
  
 
* [http://mitec.cz/wfa.htm Free tool that is capable of reading and reporting on Windows shortcut files]
 
* [http://mitec.cz/wfa.htm Free tool that is capable of reading and reporting on Windows shortcut files]
* [http://jafat.sourceforge.net/files.html Free tool (in PERL that is capable of reading and reporting on Windows shortcut files]
+
* [http://jafat.sourceforge.net/files.html Free tool (in PERL) that is capable of reading and reporting on Windows shortcut files]
 
* [http://www.i2s-lab.com/Papers/The_Windows_Shortcut_File_Format.pdf Details of the Windows shortcut file format]
 
* [http://www.i2s-lab.com/Papers/The_Windows_Shortcut_File_Format.pdf Details of the Windows shortcut file format]
  
 
[[Category:File Formats]]
 
[[Category:File Formats]]

Revision as of 10:53, 31 October 2006

Microsoft Windows Shortcut Files

File Format

  • TODO

Metadata

  • Three date/time stamps that relate to the last time the target was accessed by the given shortcut file. (More testing needs to be done to determine exactly how these date/time stamps relate to the target.)
  • The size of the target when it was last accessed.
  • Serial number of the local volume where the target was stored.
  • Network volume share name
  • Read-only, hidden, system, volume label, encryption, sparse, compressed, offline and several other target attributes.
  • TODO

External Links