Dissect Windows Shell Link binary files in local browser memory. Extract target file paths, 64-bit FILETIME timestamps, volume serial numbers, drive types, NetBIOS computer names, and Droid MAC address identifiers without uploading proprietary evidence.
In digital forensics and corporate incident investigations, suspect users frequently attempt to conceal data theft by deleting documents or unplugging external flash drives prior to device seizure. Windows Shell Link (.lnk) files serve as resilient forensic time capsules that document user activity even after the source file has been destroyed.
Whenever a user double-clicks an executable, opens an office spreadsheet, or prints an image, the Windows Shell automatically writes a corresponding .lnk file into the user's %APPDATA%\Microsoft\Windows\Recent\ directory and populates JumpLists (*.automaticDestinations-ms). These binary files conform strictly to Microsoft's open [MS-SHLLINK] binary protocol.
A standard Shell Link file begins with a fixed 76-byte (0x4C) ShellLinkHeader followed by variable-length data blocks:
Contains the fixed magic GUID 00021401-0000-0000-C000-000000000046, target file attributes (e.g., hidden, directory, system), and target timestamps (Creation, Last Access, Last Write).
Specifies how the target was accessed: local storage vs. network share. For local files, it records the Drive Type (Fixed HDD, Removable Flash Drive), the 32-bit Volume Serial Number, and the Local Base Path.
Optional relative paths, working directories, and command-line arguments. In malware triage, attackers disguise batch scripts or PowerShell stagers inside shortcut files using obfuscated command arguments.
Written by the Distributed Link Tracking Service. Records the target machine's NetBIOS computer name and two Droid Version 1 UUIDs. Because UUID v1 encodes the IEEE 802 MAC address, examiners can recover the hardware identity of the originating computer.
| LNK Artifact Field | Binary Offset | Forensic Casework Value |
|---|---|---|
DriveType |
Inside VolumeID (Offset 0x08) | Distinguishes fixed hard drives (DRIVE_FIXED: 0x03) from USB thumb drives (DRIVE_REMOVABLE: 0x02) and network shares (DRIVE_REMOTE: 0x04). |
DriveSerialNumber |
Inside VolumeID (Offset 0x0C) | A 32-bit integer assigned during FAT/NTFS volume formatting (e.g. 4A21-7B89). Matches against Registry MountedDevices to identify specific physical drives. |
TargetTimestamps |
Header 0x1C - 0x33 | Contains the target file's metadata at the exact moment the shortcut was generated or last accessed, helping prove whether a file was modified prior to copying. |
CommandLineArguments |
String Data Block | Uncovers living-off-the-land (LotL) execution where cmd.exe, powershell.exe, or mshta.exe were called via shortcut lures. |
C:\Users\<Username>\AppData\Roaming\Microsoft\Windows\Recent\C:\Users\<Username>\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\ (JumpLists)C:\Users\<Username>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\C:\Users\<Username>\Desktop\ and Startup folders.
FileReader and DataView APIs. Zero bytes are transmitted to any server.