LNK Files — Windows Shortcuts

When a user opens a file through Windows Explorer, the operating system silently creates a binary shortcut file that records the full target path — including UNC network paths to remote file shares — along with the target’s timestamps, file size, volume serial number, and in some versions, the machine’s MAC address. These LNK files persist in the user’s Recent Items folder long after the original file has been deleted, making them one of the most reliable artifacts for proving file access in forensic investigations.

What Are LNK Files?

LNK files are binary shortcut files conforming to Microsoft’s MS-SHLLINK (Shell Link Binary File Format) specification. Windows automatically creates them whenever a user opens a file, document, or application through Windows Explorer, the Start Menu, or the taskbar. The shortcut is placed in the user’s Recent Items directory and records metadata about the target file at the moment the link was created or last accessed.

The key forensic value of LNK files lies in what they store: the full target path (including network UNC paths like \\FileServer01\Finance\Q4-Report.xlsx), the target file’s creation, modification, and access timestamps, the target’s file size, the volume serial number and volume label of the drive where the target resided, and in certain versions, the MAC address of the machine that created the LNK. This means a single LNK file can prove that a specific user opened a specific file on a specific volume at a specific time — even if the original file has been deleted, the network share has been disconnected, or the USB device has been removed.

LNK files are not limited to files the user deliberately “pinned” or created shortcuts for. Windows generates them automatically for any file opened through the shell. This includes documents opened from network shares, files accessed on USB drives, and executables launched from Explorer. The user has no visible indication that these records are being created, and most users are unaware they exist.

Location & Format

File Paths

Binary Format — MS-SHLLINK

LNK files use a proprietary binary format documented in Microsoft’s [MS-SHLLINK] specification. The file consists of a ShellLinkHeader (76 bytes, fixed size) followed by optional structures: LinkTargetIDList (shell item ID list), LinkInfo (volume and path information), StringData (name, relative path, working directory, command-line arguments, icon location), and ExtraData blocks (tracker data, known folder IDs, property stores).

Key Fields in the ShellLinkHeader

LinkInfo Structure

What It Reveals

LNK files answer a specific set of investigative questions that are frequently decisive in insider threat, data exfiltration, and intellectual property theft cases:

• Did the user open a specific file? — The existence of a LNK file in the Recent Items folder proves the user accessed the target file through Windows Explorer. The LNK file’s own $MFT creation timestamp records when the first access occurred.
• What was the full path to the file? — The LocalBasePath or CommonNetworkRelativeLink field stores the complete path, including drive letter, directory structure, and filename.
• Was the file on a network share? — If the CommonNetworkRelativeLink field is populated, the target was on a network share. The full UNC path (server name, share name, subdirectory, filename) is preserved even after the share is disconnected or the server is decommissioned.
• Was the file on a USB device? — The VolumeID.DriveSerialNumber and VolumeID.VolumeLabel fields identify the volume. Cross-reference with USB device registry entries (USBSTOR) to tie the LNK to a specific removable device.
• What was the file size at the time of access? — The FileSize field records the target’s size in bytes at the time the LNK was created or updated.
• What were the target’s timestamps? — The embedded CreationTime, AccessTime, and WriteTime fields capture the target file’s MAC timestamps as they existed at the moment of access.
• What machine created the LNK? — The TrackerDataBlock (ExtraData) in some LNK files contains the MachineID (NetBIOS name) and DroidBirth fields, which include a MAC address embedded in the GUID.
• How many files from a specific location were accessed? — Enumerating all LNK files with a common UNC prefix or volume serial number quantifies the scope of access to a particular share or device.

Forensic Use Cases

1. File Access Proof After Deletion

A departing employee deletes sensitive documents from their workstation and empties the Recycle Bin before their exit interview. The original files no longer exist on disk, and $UsnJrnl entries may have rolled over. However, LNK files in the Recent Items folder prove the employee opened \\FS01\Exec\Board-Deck-Q4-2025.pptx, \\FS01\Exec\Acquisition-Target-Analysis.xlsx, and 12 other files from the executive file share over the preceding two weeks. Each LNK preserves the full UNC path, the target file size, and the target’s last-modified timestamp.

2. Network Share Access Evidence

An investigation reveals that confidential HR compensation data was leaked. The suspect claims they never accessed the HR file share. LNK files in their Recent Items folder contain entries with CommonNetworkRelativeLink values pointing to \\HR-FS\Compensation\2026-Salary-Bands.xlsx and \\HR-FS\Compensation\Exec-Bonus-Schedule.pdf. The LNK file’s $MFT creation timestamp places the access two days before the leak appeared on an external forum. The network share has since been restructured and the original path no longer exists, but the LNK preserves the evidence.

3. USB Device File Access

An employee is suspected of copying proprietary source code to a personal USB drive. LNK files show targets with LocalBasePath values like E:\Projects\firmware-v3.2\main.c where the VolumeID.DriveSerialNumber matches a USB device cataloged in the HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR registry key. The VolumeLabel reads “SANDISK-32G”. Together, these prove the user not only connected the device but actively navigated its contents and opened specific files.

4. Document Staging Before Exfiltration

In data exfiltration cases, subjects often stage files in a temporary directory before uploading them. LNK files can reveal this pattern: Recent Items may show sequential access to C:\Users\jdoe\Desktop\upload\contract-001.pdf through contract-047.pdf, establishing that the user opened and reviewed each file in the staging directory. When combined with SRUM data showing a cloud sync tool transferring the equivalent volume during the same time window, the staging-then-exfiltration workflow is fully documented.

5. Application Execution Evidence

While Prefetch is the primary execution artifact, LNK files in the Start Menu and taskbar provide supplementary evidence. If a user launched a portable application (e.g., E:\Tools\WinSCP-Portable.exe) from a USB drive, a LNK file may be created recording the full path. This is particularly valuable when Prefetch has been disabled (common on SSDs with older Windows configurations) or cleared by anti-forensics tools.

Acquisition Methods

Live System — Direct Copy

:: Copy all LNK files from the user's Recent Items
robocopy "C:\Users\jdoe\AppData\Roaming\Microsoft\Windows\Recent" C:\Evidence\LNK_Files *.lnk /S

:: Copy Jump List files (contain embedded LNK streams)
robocopy "C:\Users\jdoe\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations" C:\Evidence\JumpLists_Auto
robocopy "C:\Users\jdoe\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" C:\Evidence\JumpLists_Custom

:: Also collect Desktop shortcuts for supplementary evidence
robocopy "C:\Users\jdoe\Desktop" C:\Evidence\Desktop_LNK *.lnk

Live System — KAPE Collection

:: Using KAPE to collect all LNK and Jump List artifacts
kape.exe --tsource C: --tdest C:\Evidence\KAPE_Output --target LnkFilesAndJumpLists

:: Using Velociraptor (remote collection via VQL)
:: Artifact: Windows.KapeFiles.Targets with target "LnkFilesAndJumpLists"

Forensic Image — Direct Extraction

# Mount the forensic image (read-only)
mount -o ro,noexec,nodev /dev/sdb1 /mnt/evidence

# Copy all LNK files from each user profile
find /mnt/evidence/Users/*/AppData/Roaming/Microsoft/Windows/Recent \
     -name "*.lnk" -exec cp {} /analysis/lnk/ \;

# Copy Jump List databases
cp /mnt/evidence/Users/*/AppData/Roaming/Microsoft/Windows/Recent/AutomaticDestinations/* /analysis/jumplists/
cp /mnt/evidence/Users/*/AppData/Roaming/Microsoft/Windows/Recent/CustomDestinations/* /analysis/jumplists/

Parsing Tools & Analysis

Parsing with LECmd

:: Parse a single LNK file
LECmd.exe -f "C:\Evidence\LNK_Files\Q4-Report.xlsx.lnk" --csv C:\Analysis\LECmd_Output

:: Parse all LNK files in a directory recursively
LECmd.exe -d C:\Evidence\LNK_Files --csv C:\Analysis\LECmd_Output -q

:: Output columns include:
::   SourceFile, SourceCreated, SourceModified, SourceAccessed
::   TargetCreated, TargetModified, TargetAccessed, FileSize
::   LocalPath, NetworkShareName, NetworkSharePath
::   VolumeSerialNumber, VolumeLabel, MachineID, MacAddress

Parsing Jump Lists with JLECmd

:: Parse all Jump List files in AutomaticDestinations
JLECmd.exe -d C:\Evidence\JumpLists_Auto --csv C:\Analysis\JLECmd_Output -q

:: Jump Lists correlate file access to specific applications
:: e.g., which files were opened in Word vs. Excel vs. Notepad

Analysis Script — Network Share Access Summary

# Identify all network share paths accessed via LNK files

import pandas as pd

df = pd.read_csv('/analysis/lnk/LECmd_Output.csv')

# Filter for LNK files with network share paths
network = df[df['NetworkShareName'].notna()].copy()

# Group by share, count files accessed per share
summary = network.groupby('NetworkShareName').agg(
    FilesAccessed=('SourceFile', 'count'),
    FirstAccess=('SourceCreated', 'min'),
    LastAccess=('SourceModified', 'max'),
    TotalSize=('FileSize', 'sum')
).sort_values('FilesAccessed', ascending=False)

print(summary.to_string())

Sample Output

NetworkShareName                    FilesAccessed  FirstAccess           LastAccess            TotalSize
\\FS01\Engineering\Source-Code      14             2026-02-01 09:14      2026-02-14 16:42      847,293,440
\\FS01\HR\Compensation              3              2026-02-10 11:30      2026-02-12 14:15      2,457,600
\\FS01\Exec\Board-Materials         2              2026-02-13 08:45      2026-02-13 09:12      15,728,640
\\PRINT-SRV\Scans                   1              2026-01-22 13:00      2026-01-22 13:00      4,194,304

Retention & Persistence

Anti-Forensics Resilience

LNK files have a notable anti-forensics weakness compared to system-level artifacts like SRUM: they reside in the user’s profile directory and are standard files that can be deleted without elevated privileges. However, most cleanup tools do not target them by default.

MITRE ATT&CK Detection Mapping

LNK file analysis provides evidentiary support for detecting the following MITRE ATT&CK techniques:

Related Artifacts & Case Studies

Corroborating Artifacts

Case Study

References

1. Eric Zimmerman, “LECmd — LNK Explorer Command Line” — https://ericzimmerman.github.io/
2. Microsoft, “[MS-SHLLINK]: Shell Link (.LNK) Binary File Format” — https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/
3. SANS Institute, “Windows Forensic Analysis — LNK Files and Jump Lists” — https://www.sans.org/blog/
4. 13Cubed, “LNK Files and Jump Lists for DFIR” — https://www.13cubed.com/blog
5. ForensicArtifacts.com, “Windows LNK File Artifact Definition” — https://github.com/ForensicArtifacts/artifacts
6. Phil Harvey, “ExifTool — Read, Write and Edit Meta Information” — https://exiftool.org/
7. Eric Zimmerman, “JLECmd — Jump List Explorer Command Line” — https://ericzimmerman.github.io/
8. Harlan Carvey, “Windows Registry Forensics” — Syngress Publishing