Lnk Files

Overview

Evidence: Lnk Files Description: Collect Lnk Files Category: File System Platform: Windows Short Name: lnkfiles Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

Windows LNK (shortcut) files contain metadata about accessed files and applications, including paths, timestamps, and network locations. These files provide evidence of file access and user activity on Windows systems.

Data Collected

This collector gathers structured data about lnk files.

Lnk Files Data

Field	Description	Example
ID	Primary key (auto-increment)	1
TargetPath	Target file path	C:\Program Files\Microsoft Office\WINWORD.EXE
IsTargetExists	Whether target exists	true
TargetFileSize	Target file size in bytes	2048000
TargetCreationTime	Target creation time	2023-10-15 14:30:25
TargetAccessTime	Target access time	2023-10-15 14:30:25
TargetWriteTime	Target write time	2023-10-15 14:30:25
TargetHash	Target file hash	sha256:abc123...
LNKPath	LNK file path	C:\Users\Administrator\Desktop\Word.lnk
LNKCreationTime	LNK creation time	2023-10-15 14:30:25
LNKAccessTime	LNK access time	2023-10-15 14:30:25
LNKWriteTime	LNK write time	2023-10-15 14:30:25
Window	Window state	Normal
HotKey	Hotkey combination	Ctrl+Alt+W
CommonPathSuffix	Common path suffix	WINWORD.EXE
NetworkProviderType	Network provider type	Microsoft Windows Network
NetName	Network name	\\SERVER\SHARE
DeviceName	Device name	Z:
DriveType	Drive type	Fixed
DriveSerialNumber	Drive serial number	12345678
VolumeLabel	Volume label	C:
Comment	LNK comment	Microsoft Word
RelativePath	Relative path	..\..\Program Files\Microsoft Office\WINWORD.EXE
WorkingDir	Working directory	C:\Users\Administrator\Documents
CommandLineArguments	Command line arguments	/n
IconLocation	Icon location	C:\Program Files\Microsoft Office\WINWORD.EXE,0

Collection Method

This collector parses the necessary data from the lnk_files table.

This collector collects files from the following locations:

• %APPDATA%\Microsoft\Windows\Recent\

• %USERPROFILE%\Recent\

Usage

This evidence is crucial for forensic investigations as it provides file access and user activity information. It helps investigators understand user behavior, detect unauthorized file access, and investigate file-based attacks. The data can reveal accessed files, network locations, and potential data exfiltration. Analysts can use this information to identify file compromises, trace user activities, and assess file system security.

Notes

This data may contain sensitive information that should be handled according to data protection requirements. Ensure proper chain of custody is maintained during collection and analysis.