--- title: "A Deep Dive into LNK Files | Windows Forensics" url: https://daily.dev/posts/a-deep-dive-into-lnk-files-windows-forensics-qn5ytrfkw source_url: https://infosecwriteups.com/a-deep-dive-into-lnk-files-windows-forensics-5a4338c803b5 type: article source: "InfoSec Write-ups" published: 2026-08-10T09:25:15.156Z updated: 2026-08-10T09:26:41.261Z tags: ["malware"] reading_time: 7 upvotes: 1 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A Deep Dive into LNK Files | Windows Forensics **[InfoSec Write-ups](https://daily.dev/sources/infosecwriteups)** · 7 min read · 1 upvotes · 0 comments ## Summary LNK (shortcut) files are automatically created by Windows whenever users interact with files, folders, or applications, making them valuable forensic artifacts. Even after the original file is deleted, LNK files preserve metadata including original file path, volume serial number, drive type, machine name, and timestamps. The post explains the source vs. target distinction, how to interpret timestamps (noting Last Access is unreliable), and how LNK files can reveal access to USB drives and network shares. It covers parsing LNK files with LECmd by Eric Zimmerman, correlating them with Jump Lists, ShellBags, and USB artifacts for timeline reconstruction, and how attackers abuse malicious LNK files to execute hidden commands. Key limitations are also noted: a missing LNK does not prove a file was never accessed, and its presence does not prove the user read the file's contents. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What forensic information is stored inside a Windows LNK file? A Windows LNK file stores the original file path, working directory, file size, file attributes, drive type (local, removable, or network), volume serial number, volume label, UNC path for network shares, machine name, tracker information, and multiple timestamps. These fields can reveal what file was accessed, where it came from, and how it was accessed — even after the original file has been deleted. _Forensic investigators tracking Windows artifacts follow LNK research and tooling updates on daily.dev._ ### What do the timestamps in a Windows LNK file mean and which ones are reliable? LNK files contain four main timestamps: Source Created (usually the first recorded interaction with the target), Source Modified (most recent interaction), Target Created (creation time of the original file), and Target Modified (last modification of the original file). The Last Access timestamp is considered unreliable and should not be heavily relied upon. If Target Created is newer than Target Modified, the file was likely copied or moved rather than originally created there. _Windows forensics practitioners keep up with artifact interpretation nuances like these on daily.dev._ ### How do I parse Windows LNK files during a forensic investigation? LECmd by Eric Zimmerman is the most widely used tool for parsing LNK files. It extracts binary metadata into a readable format and can process hundreds of shortcut files at once. A typical workflow involves parsing the Recent folder, exporting results to CSV, sorting by first or last interaction time, renaming columns for clarity, and removing unnecessary fields while preserving the original dataset. _Practitioners doing Windows forensic investigations find tool updates and workflow tips on daily.dev._ ## Similar posts on daily.dev - [Four new reasons why Windows LNK files cannot be trusted](https://daily.dev/posts/four-new-reasons-why-windows-lnk-files-cannot-be-trusted-obirvmftm) · CSO Online · 0 upvotes · 0 comments --- Tags: [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/a-deep-dive-into-lnk-files-windows-forensics-qn5ytrfkw)