LNK Files Forensics Cheat Sheet

What it is

A .lnk file is a Windows shortcut (Shell Link). Besides the shortcuts users and installers create on the Desktop or in the Start menu, Windows Explorer silently creates one in the user's Recent folder every time a file is opened through the shell. Each LNK stores a snapshot of its target: full path, shell item list, size, timestamps and details of the volume or share it lived on. Because the shortcut is independent of the target, it survives when the file is deleted, the USB stick is unplugged or the share is gone.

Location

Windows version	Path	Notes
XP	`C:\Documents and Settings\<user>\Recent\`	Automatic "recent" shortcuts
Vista / 7 / 8 / 10 / 11	`C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\`	Automatic shortcuts for opened files, and on recent versions also for their parent folders
All (older Office versions)	`C:\Users\<user>\AppData\Roaming\Microsoft\Office\Recent\`	Shortcuts created by Office applications
All	`C:\Users\<user>\Desktop\`, `...\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\`, `C:\ProgramData\Microsoft\Windows\Start Menu\Programs\`	User- or installer-created shortcuts
7 and later	Inside Jump Lists	Same LNK format, embedded as streams or entries

Automatic Recent shortcuts are named after the target (report.docx.lnk), not after its full path. A later open of a different file with the same name updates the same shortcut.

What it proves

File or folder opening: the user opened the target through the shell (Explorer, open dialogs, double-click), at least once.
Where it lived: full path, drive type (fixed, removable, network, CD-ROM), volume serial number and volume label, or the UNC share name. This ties a file to a specific USB device or server.
Target metadata at the time: size and created/modified/accessed times of the target, useful when the file no longer exists.
Origin machine: the TrackerDataBlock carries the NetBIOS name of the machine and a MAC address found in the object identifiers.
It does not prove the file was read, edited or copied, nor which application opened it (use Jump Lists for the application).

Key fields

Field	Meaning
Header target times	Creation, access and write FILETIME values of the target, copied into the shortcut
Header file size and attributes	Target size (32-bit) and file attributes
LinkTargetIDList	Shell item list describing the path, including folder entries with their own timestamps and, on NTFS, MFT references
LinkInfo: volume information	Drive type, drive serial number, volume label, local base path
LinkInfo: network share information	Share name (`\\server\share`) and mapped drive letter for remote targets
String data	Relative path, working directory, command-line arguments, icon location
TrackerDataBlock	Machine identifier (NetBIOS name, 16 bytes), droid volume and file identifiers, birth droid identifiers
MAC address	Node field of the version-1 UUID stored as droid file identifier

Timestamps

Timestamp	Set when	Format	Pitfalls
LNK file creation ($SI)	Shortcut first created: first time a file of that name was opened	NTFS, UTC	Reset if the LNK was deleted and recreated
LNK file modification ($SI)	Shortcut updated: last time a file of that name was opened	NTFS, UTC	Name-based: may relate to a different file with the same name
Target created / modified / accessed (header)	Copied from the target when the shortcut was written or updated	FILETIME, UTC	Describe the target, not the user action; zero when unavailable
Folder times in shell items	Copied from each folder when the item was built	DOS date/time, 2-second resolution	Describe the folder, not the access
Droid UUID time	When the NTFS object ID was generated	UUID v1 timestamp	Relates to the object ID, not to the opening

Retention and clearing

Recent shortcuts accumulate until the user or Windows removes them. Entry limits differ between sources and versions, so the absence of a shortcut does not prove a file was never opened.
Tracking is disabled when Start_TrackDocs is 0 under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced ("Show recently opened items" setting), and by Group Policy privacy settings.
Clearing File Explorer history, privacy cleaners or manual deletion remove the files. Deleted LNKs can often be recovered from $MFT entries, volume shadow copies or by carving (signature 4C 00 00 00 followed by the Shell Link CLSID).
Desktop and Start menu shortcuts persist until removed; they reflect creation by a user or an installer, not opening.

Collection

KAPE target: LNKFilesAndJumpLists (Recent, Office Recent, Desktop, Start menu, XP paths), or RecentFolders for the two Recent folders only.
Velociraptor (Windows.Triage.Targets): LNKFilesAndJumpLists or RecentFolders. Windows.Forensics.Lnk parses shortcuts live and flags suspicious ones.
Built-in: the files are not locked. Keep the LNK file times, which carry the first/last open meaning:

robocopy "C:\Users\alice\AppData\Roaming\Microsoft\Windows\Recent" E:\case\alice\Recent *.lnk /COPY:DAT /DCOPY:T
Get-ChildItem "C:\Users\*\AppData\Roaming\Microsoft\Windows\Recent\*.lnk" -Force | Select-Object FullName, CreationTimeUtc, LastWriteTimeUtc

Parsing tools

LECmd (Eric Zimmerman, free): LECmd.exe -d E:\case --csv E:\out --all parses every LNK recursively, including shell items, tracker data and MAC address.
liblnk / pylnk (Joachim Metz, open source): lnkinfo plus the reference format documentation.
Velociraptor: Windows.Forensics.Lnk with regex filters on arguments, hostnames and MAC prefixes.
Plaso: the lnk parser adds LNK timestamps to a super timeline.

Investigation tips

Filter on drive type "removable" and pivot on the volume serial number to match USB device history and prove which stick held a document.
Network share paths reveal access to file servers; combine with ShellBags to see the folders browsed around them.
A TrackerDataBlock NetBIOS name or MAC address that differs from the examined host shows the LNK or the target came from another machine, typical of phishing attachments.
Malicious LNKs (email, ISO, ZIP) often point to cmd.exe, powershell.exe or mshta.exe with long arguments; review the arguments field and correlate with Prefetch.
Compare Recent LNKs with RecentDocs and Office MRU: each covers gaps in the others.
Remember the name-based semantics: two different invoice.pdf files opened from different folders share one Recent shortcut.

LNK shortcut files

Tools