From ForensicsWiki
Revision as of 14:53, 31 October 2006 by Jakec (Talk | contribs)

Jump to: navigation, search

Microsoft Windows Shortcut Files

File Format

  • TODO


  • Three date/time stamps that relate to the last time the target was accessed by the given shortcut file. (More testing needs to be done to determine exactly how these date/time stamps relate to the target.)
  • The size of the target when it was last accessed.
  • Serial number of the local volume where the target was stored.
  • Network volume share name
  • Read-only, hidden, system, volume label, encryption, sparse, compressed, offline and several other target attributes.
  • TODO

External Links