From Forensics Wiki
Revision as of 14:24, 13 March 2006 by Mkucenski
MS Windows Shortcut Files
In addition the target file, Windows shortcut files contain several interesting pieces of information that include:
- Three date/time stamps that relate to the last time the target was accessed by the given shortcut file. (More testing needs to be done to determine exactly how these date/time stamps relate to the target.)
- The size of the target when it was last accessed.
- Serial number of the local volume where the target was stored.
- Network volume share name
- Read-only, hidden, system, volume label, encryption, sparse, compressed, offline and several other target attributes.
Specific details of .lnk shortcut files can be found here: Windows Shortcut File Format