analyzing-windows-lnk-files-for-artifacts

# Analyzing Windows LNK Files for Artifacts ## When to Use - When reconstructing user file access history from Windows shortcut files - For tracking accessed files, network shares, and removable media - During investigations to prove a user opened specific documents - When correlating file access with other timeline artifacts - For identifying accessed paths on remote systems or USB devices ## Prerequisites - Access to LNK files from forensic image (Recent, Desktop, Quick Launch) - LECmd (Eric Zimmerman), python-lnk, or LnkParser for analysis - Understanding of LNK file structure (Shell Link Binary format) - Knowledge of LNK file locations on Windows systems - Forensic workstation with analysis tools installed ## Workflow ### Step 1: Collect LNK Files from Forensic Image ```bash # Mount forensic image mount -o ro,loop,offset=$((2048*512)) /cases/case-2024-001/images/evidence.dd /mnt/evidence mkdir -p /cases/case-2024-001/lnk/{recent,desktop,startup,custom} # Copy Recent items LNK files (primary source) cp /mnt/evidence/Users/*/AppData/Roaming/Microsoft/Windows/Recent/*.lnk \ /cases/case-2024-001/lnk/recent/ 2>/dev/null # Copy automatic destinations (Jump Lists) cp /mnt/evidence/Users/*/AppData/Roaming/Microsoft/Windows/Recent/AutomaticDestinations/*.automaticDestinations-ms \ /cases/case-2024-001/lnk/recent/ 2>/dev/null # Copy custom destinations (pinned Jump List items) cp /mnt/evidence/Users/*/AppData/Roaming/Microsoft/Windows/Recent/CustomDestinations/*.cust...