Difference between revisions of "LNK"

From Forensics Wiki
Jump to: navigation, search
m
Line 12: Line 12:
 
* Read-only, hidden, system, volume label, encryption, sparse, compressed, offline and several other target attributes.
 
* Read-only, hidden, system, volume label, encryption, sparse, compressed, offline and several other target attributes.
  
 
+
==External Links==
 
Specific details of .lnk shortcut files can be found here:
 
Specific details of .lnk shortcut files can be found here:
 
[http://www.i2s-lab.com/Papers/The_Windows_Shortcut_File_Format.pdf Windows Shortcut File Format]
 
[http://www.i2s-lab.com/Papers/The_Windows_Shortcut_File_Format.pdf Windows Shortcut File Format]
  
 
[[Category:File Formats]]
 
[[Category:File Formats]]

Revision as of 17:08, 27 September 2006

40px-Ambox warning pn.png

This article, and others, needs to be wikified.
Please remove this template after wikifying.

MS Windows Shortcut Files


In addition the target file, Windows shortcut files contain several interesting pieces of information that include:

  • Three date/time stamps that relate to the last time the target was accessed by the given shortcut file. (More testing needs to be done to determine exactly how these date/time stamps relate to the target.)
  • The size of the target when it was last accessed.
  • Serial number of the local volume where the target was stored.
  • Network volume share name
  • Read-only, hidden, system, volume label, encryption, sparse, compressed, offline and several other target attributes.

External Links

Specific details of .lnk shortcut files can be found here: Windows Shortcut File Format