LNK

From ForensicsWiki
Revision as of 18:12, 27 September 2006 by Mkucenski (Talk | contribs)

Jump to: navigation, search

40px-Ambox warning pn.png

This article, and others, needs to be wikified.
Please remove this template after wikifying.

MS Windows Shortcut Files


In addition the target file, Windows shortcut files contain several interesting pieces of information that include:

  • Three date/time stamps that relate to the last time the target was accessed by the given shortcut file. (More testing needs to be done to determine exactly how these date/time stamps relate to the target.)
  • The size of the target when it was last accessed.
  • Serial number of the local volume where the target was stored.
  • Network volume share name
  • Read-only, hidden, system, volume label, encryption, sparse, compressed, offline and several other target attributes.

External Links