Individual skill
analyzing-windows-lnk-files-for-artifacts
Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.
internal/tools/skills/data/digital-forensics/analyzing-windows-lnk-files-for-artifacts/SKILL.md
Source commit d42f381ad34843e71a42658e5c57290c713e85af
What was checked
- Matches the observed repository HEAD
- Yes
- Scanner rules are current
- Yes
- Repository scan complete
- No
- Skill scan complete
- No
- Observed behavior
- Instructions only
- Last checked
- Nov 9, 2026
These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.
Install this skill
Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.
An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.
Repository context
- Repository stars (not skill ratings)
- 1,313
- Repository last updated
- Nov 8, 2026
- License
- Apache-2.0
Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.
- cybersecurity Repository topic
- security Repository topic
- bug-bounty Repository topic
- automation Repository topic
- autonomous-pentesting Repository topic
- ai-agent Repository topic
- ai-security Repository topic
- ethical-hacking Repository topic
- golang Repository topic
- penetration-testing Repository topic
- forensics Declared skill tag
- lnk-files Declared skill tag
- windows-artifacts Declared skill tag
- shortcut-analysis Declared skill tag
- timeline-reconstruction Declared skill tag
- evidence-collection Declared skill tag
- engineering Derived category
Files and excerpt
File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.
Browse files
Read excerpt
# Analyzing Windows LNK Files for Artifacts
## When to Use
- When reconstructing user file access history from Windows shortcut files
- For tracking accessed files, network shares, and removable media
- During investigations to prove a user opened specific documents
- When correlating file access with other timeline artifacts
- For identifying accessed paths on remote systems or USB devices
## Detection Gaps & Validation
- **LNK presence does not prove a human opened the file.** Some shortcuts are auto-created (installers, Office MRU, pinned items). Distinguish user-driven Recent/AutomaticDestinations entries from programmatically created ones before asserting intent.
- **Most-missed artifact: the Jump List `DestList` stream.** `AutomaticDestinations-ms` files carry an MRU-ordered `DestList` with access counts and last-access times — richer than the embedded LNK alone. Parse with JLECmd, not just LECmd.
- **Target MAC timestamps are a snapshot.** The creation/modified/accessed times embedded in the LNK reflect the target *at the moment the shortcut was written* and can be stale or timestomped; they are not a live filesystem read.
- **DistributedLinkTracker droid** preserves the original volume serial and MAC even after a file is copied between machines — powerful for attribution, but it points to the *creating* host, which can mislead if the LNK itself was copied.