> For the complete documentation index, see [llms.txt](https://nk0.gitbook.io/dfir/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://nk0.gitbook.io/dfir/windows/forensics/evidence-of-execution/lnk-files.md).

# LNK Files

<figure><img src="/files/JKAb5gKINKELhbjO8uPC" alt=""><figcaption></figcaption></figure>

File Location:

* C:\Users\USERNAME\Appdata\Romaing\Microsoft\Windows\Recent

### Parse Data

```sh
#Parsing on Linux
exiftool TEST.lnk
```

* File Timestamps are for the LNK file (Top 3).
* Date timestamps are for the source file (Bottom 3).
* Target File Size - Source file size
* Volumne Label - Drive label
* Machine ID - Machine name
* Mac Address could be possible

<figure><img src="/files/KcEULlNUBA1m2UuIOpFN" alt=""><figcaption></figcaption></figure>

<pre class="language-powershell" data-overflow="wrap"><code class="lang-powershell"><strong>#LECmd output
</strong><strong>LECmd.exe -d F:\Tools\Investigation\Logs\logs2 --csv F:\Tools\Investigation\Logs\logs2\output.csv
</strong></code></pre>

* Shows all the same information as Exiftool, but inludes more.

<figure><img src="/files/J7HVioPIDRWKR6LSAPdj" alt=""><figcaption></figcaption></figure>

### Considerations

* Shortcuts for folders will not show the size of the objects in the folder.

<figure><img src="/files/V2rKLcmnTUcvGeOLEnN1" alt=""><figcaption></figcaption></figure>

* LNK entries are created for non-executables in recents folder.
* Windows GUI only displays up to 260 characters when viewing properties of LNK file. Can be used to hide malicious command lines from GUI inspection.
* Creating a file will create an LNK entry in recents for Windows 10+

<figure><img src="/files/HG7UbGnLmfBezGVvnjMT" alt=""><figcaption></figcaption></figure>

* Modifying the source file will modify the M timestamp for the LNK file.

<figure><img src="/files/jTw4N97eoe2DyqBk7ZjL" alt=""><figcaption></figcaption></figure>

* Opening the source file will also update M timestamp in the LNK file.

<figure><img src="/files/EtSXqFwYNefjbJtNXx6G" alt=""><figcaption></figcaption></figure>

<figure><img src="/files/3Kr1VSKA3KklOW0eJtwY" alt=""><figcaption></figcaption></figure>

### Anti-Forensics

* Delete Recents directory.
* LNK files will still persist after source file is deleted.