[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ADPCY1VJ997SYBX7QNPXT2":3,"skill-same:01M6ADPCY1VJ997SYBX7QNPXT2":132},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":36,"linkOnly":37,"markdownContent":38,"markdownBody":39,"frontMatter":40,"refName":53,"commitSha":54,"skillDirectory":55,"forksCount":56,"repositoryHtmlUrl":57,"repositoryHomepageUrl":58,"ownerHtmlUrl":59,"ownerBlogUrl":60,"ownerDescription":61,"updatedAt":62,"install":63,"resources":76},"01M6ADPCY1VJ997SYBX7QNPXT2","analyzing-lnk-file-and-jump-list-artifacts",null,"Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file access, program execution, and user activity that persists even after the target file is deleted. Use when investigating Windows user activity, reconstructing file-access or program-execution timelines, or examining recent\u002Ffrequently-used file evidence in a forensic exam.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35],"analyzing lnk file and jump list artifacts","artifacts","file","lecmd","recent-files","program-execution","file-access","user-activity","shell-link","windows-forensics","jlecmd","file access","jump-lists","lnk-files","forensics","windows","cybersecurity","2026-11-10 10:12:30",false,"---\nname: analyzing-lnk-file-and-jump-list-artifacts\ndescription: Analyze Windows LNK shortcut files and Jump List artifacts with LECmd,\n  JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file\n  access, program execution, and user activity that persists even after the target\n  file is deleted. Use when investigating Windows user activity, reconstructing file-access\n  or program-execution timelines, or examining recent\u002Ffrequently-used file evidence\n  in a forensic exam.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- lnk-files\n- jump-lists\n- lecmd\n- jlecmd\n- windows-forensics\n- shell-link\n- user-activity\n- file-access\n- program-execution\n- recent-files\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1547.009\n- T1204.002\n- T1059.001\n---\n\n# Analyzing LNK File and Jump List Artifacts\n\n## Overview\n\nWindows LNK (shortcut) files and Jump Lists are critical forensic artifacts that provide evidence of file access, program execution, and user behavior. LNK files are created automatically when a user opens a file through Windows Explorer or the Open\u002FSave dialog, storing metadata about the target file including its original path, timestamps, volume serial number, NetBIOS name, and MAC address of the host system. Jump Lists, introduced in Windows 7, extend this by maintaining per-application lists of recently and frequently accessed files. These artifacts persist even after the target files are deleted, making them invaluable for establishing that a user accessed specific files at specific times.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing lnk file and jump list artifacts\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- LECmd (Eric Zimmerman) for LNK file parsing\n- JLECmd (Eric Zimmerman) for Jump List parsing\n- Python 3.8+ with pylnk3 or LnkParse3 libraries\n- Forensic image or triage collection from Windows system\n- Timeline Explorer for CSV analysis\n\n## LNK File Locations\n\n| Location | Description |\n|----------|-------------|\n| `%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\` | Recent files accessed |\n| `%USERPROFILE%\\Desktop\\` | User-created shortcuts |\n| `%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\` | Start Menu shortcuts |\n| `%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\` | Office recent documents |\n\n## LNK File Structure\n\n### Shell Link Header (76 bytes)\n\n| Offset | Size | Field |\n|--------|------|-------|\n| 0x00 | 4 | HeaderSize (always 0x0000004C) |\n| 0x04 | 16 | LinkCLSID (always 00021401-0000-0000-C000-000000000046) |\n| 0x14 | 4 | LinkFlags |\n| 0x18 | 4 | FileAttributes |\n| 0x1C | 8 | CreationTime (FILETIME) |\n| 0x24 | 8 | AccessTime (FILETIME) |\n| 0x2C | 8 | WriteTime (FILETIME) |\n| 0x34 | 4 | FileSize of target |\n| 0x38 | 4 | IconIndex |\n| 0x3C | 4 | ShowCommand |\n| 0x40 | 2 | HotKey |\n\n### Key Forensic Fields in LNK Files\n\n- **Target file timestamps**: Creation, access, modification times of the referenced file\n- **Volume information**: Serial number, drive type, volume label\n- **Network share information**: UNC path, share name\n- **Machine identifiers**: NetBIOS name, MAC address (from TrackerDataBlock)\n- **Distributed Link Tracking**: Machine ID and object GUID\n\n## Analysis with EZ Tools\n\n### LECmd - LNK File Parser\n\n```powershell\n# Parse all LNK files in Recent folder\nLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\" --csv C:\\Output --csvf lnk_analysis.csv\n\n# Parse a single LNK file with full details\nLECmd.exe -f \"C:\\Evidence\\Users\\suspect\\Desktop\\Confidential.docx.lnk\" --json C:\\Output\n\n# Parse LNK files with additional detail levels\nLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\" --csv C:\\Output --csvf lnk_all.csv --all\n```\n\n### JLECmd - Jump List Parser\n\n```powershell\n# Parse Automatic Jump Lists\nJLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\" --csv C:\\Output --csvf jumplists_auto.csv\n\n# Parse Custom Jump Lists\nJLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\" --csv C:\\Output --csvf jumplists_custom.csv\n\n# Parse all jump lists with detailed output\nJLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\" --csv C:\\Output --csvf jumplists_auto.csv --ld\n```\n\n## Jump List Structure\n\n### Automatic Destinations (automaticDestinations-ms)\n\nThese are OLE Compound files (Structured Storage) identified by AppID hash in the filename:\n\n| AppID Hash | Application |\n|-----------|-------------|\n| 5f7b5f1e01b83767 | Windows Explorer Pinned\u002FFrequent |\n| 1b4dd67f29cb1962 | Windows Explorer Recent |\n| 9b9cdc69c1c24e2b | Notepad |\n| a7bd71699cd38d1c | Notepad++ |\n| 12dc1ea8e34b5a6 | Microsoft Paint |\n| 7e4dca80246863e3 | Control Panel |\n| 1cf97c38a5881255 | Microsoft Edge |\n| f01b4d95cf55d32a | Windows Explorer |\n| 9d1f905ce5044aee | Microsoft Excel |\n| a4a5324453625195 | Microsoft Word |\n| d00655d2aa12ff6d | Microsoft PowerPoint |\n| bc03160ee1a59fc1 | Outlook |\n\n### Custom Destinations (customDestinations-ms)\n\nCreated when users pin items to application jump lists. These files contain sequential LNK entries.\n\n## Python Analysis Script\n\n```python\nimport struct\nimport os\nfrom datetime import datetime, timedelta\n\nFILETIME_EPOCH = datetime(1601, 1, 1)\n\ndef filetime_to_datetime(filetime_bytes: bytes) -> datetime:\n    \"\"\"Convert Windows FILETIME (100-ns intervals since 1601) to datetime.\"\"\"\n    ft = struct.unpack(\"\u003CQ\", filetime_bytes)[0]\n    if ft == 0:\n        return None\n    return FILETIME_EPOCH + timedelta(microseconds=ft \u002F\u002F 10)\n\ndef parse_lnk_header(lnk_path: str) -> dict:\n    \"\"\"Parse the Shell Link header from an LNK file.\"\"\"\n    with open(lnk_path, \"rb\") as f:\n        header = f.read(76)\n\n    header_size = struct.unpack(\"\u003CI\", header[0:4])[0]\n    if header_size != 0x4C:\n        return {\"error\": \"Invalid LNK header\"}\n\n    link_flags = struct.unpack(\"\u003CI\", header[0x14:0x18])[0]\n    file_attrs = struct.unpack(\"\u003CI\", header[0x18:0x1C])[0]\n\n    result = {\n        \"header_size\": header_size,\n        \"link_flags\": hex(link_flags),\n        \"file_attributes\": hex(file_attrs),\n        \"creation_time\": filetime_to_datetime(header[0x1C:0x24]),\n        \"access_time\": filetime_to_datetime(header[0x24:0x2C]),\n        \"write_time\": filetime_to_datetime(header[0x2C:0x34]),\n        \"file_size\": struct.unpack(\"\u003CI\", header[0x34:0x38])[0],\n        \"has_target_id_list\": bool(link_flags & 0x01),\n        \"has_link_info\": bool(link_flags & 0x02),\n        \"has_name\": bool(link_flags & 0x04),\n        \"has_relative_path\": bool(link_flags & 0x08),\n        \"has_working_dir\": bool(link_flags & 0x10),\n        \"has_arguments\": bool(link_flags & 0x20),\n        \"has_icon_location\": bool(link_flags & 0x40),\n    }\n    return result\n```\n\n## Investigation Use Cases\n\n### Evidence of File Access\n1. Parse LNK files from Recent folder to identify accessed documents\n2. Cross-reference with MFT timestamps and USN Journal entries\n3. Note that LNK files persist even after target files are deleted\n\n### Removable Media Access\n1. LNK files referencing drive letters E:, F:, G: indicate removable media usage\n2. Volume serial number in LNK identifies the specific device\n3. MAC address in TrackerDataBlock identifies the source machine\n\n### Network Share Activity\n1. LNK files with UNC paths (\\\\server\\share) indicate network file access\n2. NetBIOS name identifies the remote server\n3. Timestamps establish when access occurred\n\n## Differences Between Windows 10 and Windows 11\n\nRecent research (IEEE 2025) shows that Windows 11 produces different LNK and Jump List artifacts:\n- Fewer automatic LNK files generated for certain file types\n- Modified Jump List behavior for modern applications\n- UWP\u002FMSIX applications may not generate traditional Jump Lists\n- Windows 11 Quick Access replaces some Recent functionality\n\n## References\n\n- Shell Link Binary File Format: https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fopenspecs\u002Fwindows_protocols\u002Fms-shllink\u002F\n- Magnet Forensics LNK Analysis: https:\u002F\u002Fwww.magnetforensics.com\u002Fblog\u002Fforensic-analysis-of-lnk-files\u002F\n- Jump Lists Forensics 2025: https:\u002F\u002Fwww.cybertriage.com\u002Fblog\u002Fjump-list-forensics-2025\u002F\n- Eric Zimmerman's LECmd\u002FJLECmd: https:\u002F\u002Fericzimmerman.github.io\u002F\n\n## Example Output\n\n```text\n$ LECmd.exe -d \"C:\\Evidence\\Users\\jsmith\\AppData\\Roaming\\Microsoft\\Windows\\Recent\" --csv \u002Fanalysis\u002Flnk_output\n\nLECmd v1.11.0 - LNK File Parser\n================================\n\nProcessing 47 LNK files...\n\n--- LNK File: Q4_Report.xlsx.lnk ---\n  Source:           C:\\Evidence\\Users\\jsmith\\Recent\\Q4_Report.xlsx.lnk\n  Target Path:      C:\\Users\\jsmith\\Downloads\\Q4_Report.xlsm\n  Target Created:   2024-01-15 14:33:45 UTC\n  Target Modified:  2024-01-15 14:33:45 UTC\n  Target Accessed:  2024-01-15 14:35:12 UTC\n  File Size:        251,904 bytes\n  Drive Type:       Fixed (C:)\n  Volume Serial:    A4E7-3F21\n  Machine ID:       DESKTOP-J5M1TH\n  MAC Address:      48:2A:E3:5C:9B:01\n\n--- LNK File: update_client.exe.lnk ---\n  Source:           C:\\Evidence\\Users\\jsmith\\Recent\\update_client.exe.lnk\n  Target Path:      C:\\ProgramData\\Updates\\update_client.exe\n  Target Created:   2024-01-15 14:34:02 UTC\n  Target Modified:  2024-01-15 14:34:02 UTC\n  Target Accessed:  2024-01-15 14:36:30 UTC\n  File Size:        1,258,496 bytes\n  Drive Type:       Fixed (C:)\n  Volume Serial:    A4E7-3F21\n  Machine ID:       DESKTOP-J5M1TH\n  Working Dir:      C:\\ProgramData\\Updates\n  Arguments:        --silent --no-update-check\n  Run Window:       Hidden\n\n======================================================================\n\n$ JLECmd.exe -d \"C:\\Evidence\\Users\\jsmith\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\" --csv \u002Fanalysis\u002Fjumplist_output\n\nJLECmd v1.5.0 - Jump List Parser\n==================================\n\nProcessing 23 AutomaticDestinations files...\n\n--- Application: Microsoft Excel (AppID: 12dc1ea8e34b5a6) ---\n  Entries: 15\n  Most Recent:\n    Entry 0:  C:\\Users\\jsmith\\Downloads\\Q4_Report.xlsm         (2024-01-15 14:35:12 UTC)\n    Entry 1:  \\\\FILESERV01\\Finance\\Budget_2024.xlsx             (2024-01-14 09:22:30 UTC)\n    Entry 2:  C:\\Users\\jsmith\\Documents\\Expenses\\Dec2023.xlsx   (2024-01-10 16:45:00 UTC)\n\n--- Application: Windows Explorer (AppID: f01b4d95cf55d32a) ---\n  Entries: 28\n  Most Recent:\n    Entry 0:  C:\\ProgramData\\Updates\\                           (2024-01-15 14:36:25 UTC)\n    Entry 1:  E:\\Backup\\                                        (2024-01-15 15:30:00 UTC)\n    Entry 2:  \\\\FILESERV01\\HR\\Employees\\                        (2024-01-15 16:12:45 UTC)\n\n--- Application: cmd.exe (AppID: 9b9cdc69c1c24e2b) ---\n  Entries: 5\n  Most Recent:\n    Entry 0:  C:\\Windows\\System32\\cmd.exe                       (2024-01-15 14:36:00 UTC)\n\nSummary:\n  Total LNK files processed:    47\n  Total Jump List entries:       156\n  Suspicious artifacts:          3 (hidden window execution, USB drive access, network shares)\n  CSV exported to:               \u002Fanalysis\u002Flnk_output\u002F and \u002Fanalysis\u002Fjumplist_output\u002F\n```\n","# Analyzing LNK File and Jump List Artifacts\n\n## Overview\n\nWindows LNK (shortcut) files and Jump Lists are critical forensic artifacts that provide evidence of file access, program execution, and user behavior. LNK files are created automatically when a user opens a file through Windows Explorer or the Open\u002FSave dialog, storing metadata about the target file including its original path, timestamps, volume serial number, NetBIOS name, and MAC address of the host system. Jump Lists, introduced in Windows 7, extend this by maintaining per-application lists of recently and frequently accessed files. These artifacts persist even after the target files are deleted, making them invaluable for establishing that a user accessed specific files at specific times.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing lnk file and jump list artifacts\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- LECmd (Eric Zimmerman) for LNK file parsing\n- JLECmd (Eric Zimmerman) for Jump List parsing\n- Python 3.8+ with pylnk3 or LnkParse3 libraries\n- Forensic image or triage collection from Windows system\n- Timeline Explorer for CSV analysis\n\n## LNK File Locations\n\n| Location | Description |\n|----------|-------------|\n| `%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\` | Recent files accessed |\n| `%USERPROFILE%\\Desktop\\` | User-created shortcuts |\n| `%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\` | Start Menu shortcuts |\n| `%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\` | Office recent documents |\n\n## LNK File Structure\n\n### Shell Link Header (76 bytes)\n\n| Offset | Size | Field |\n|--------|------|-------|\n| 0x00 | 4 | HeaderSize (always 0x0000004C) |\n| 0x04 | 16 | LinkCLSID (always 00021401-0000-0000-C000-000000000046) |\n| 0x14 | 4 | LinkFlags |\n| 0x18 | 4 | FileAttributes |\n| 0x1C | 8 | CreationTime (FILETIME) |\n| 0x24 | 8 | AccessTime (FILETIME) |\n| 0x2C | 8 | WriteTime (FILETIME) |\n| 0x34 | 4 | FileSize of target |\n| 0x38 | 4 | IconIndex |\n| 0x3C | 4 | ShowCommand |\n| 0x40 | 2 | HotKey |\n\n### Key Forensic Fields in LNK Files\n\n- **Target file timestamps**: Creation, access, modification times of the referenced file\n- **Volume information**: Serial number, drive type, volume label\n- **Network share information**: UNC path, share name\n- **Machine identifiers**: NetBIOS name, MAC address (from TrackerDataBlock)\n- **Distributed Link Tracking**: Machine ID and object GUID\n\n## Analysis with EZ Tools\n\n### LECmd - LNK File Parser\n\n```powershell\n# Parse all LNK files in Recent folder\nLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\" --csv C:\\Output --csvf lnk_analysis.csv\n\n# Parse a single LNK file with full details\nLECmd.exe -f \"C:\\Evidence\\Users\\suspect\\Desktop\\Confidential.docx.lnk\" --json C:\\Output\n\n# Parse LNK files with additional detail levels\nLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\" --csv C:\\Output --csvf lnk_all.csv --all\n```\n\n### JLECmd - Jump List Parser\n\n```powershell\n# Parse Automatic Jump Lists\nJLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\" --csv C:\\Output --csvf jumplists_auto.csv\n\n# Parse Custom Jump Lists\nJLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\" --csv C:\\Output --csvf jumplists_custom.csv\n\n# Parse all jump lists with detailed output\nJLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\" --csv C:\\Output --csvf jumplists_auto.csv --ld\n```\n\n## Jump List Structure\n\n### Automatic Destinations (automaticDestinations-ms)\n\nThese are OLE Compound files (Structured Storage) identified by AppID hash in the filename:\n\n| AppID Hash | Application |\n|-----------|-------------|\n| 5f7b5f1e01b83767 | Windows Explorer Pinned\u002FFrequent |\n| 1b4dd67f29cb1962 | Windows Explorer Recent |\n| 9b9cdc69c1c24e2b | Notepad |\n| a7bd71699cd38d1c | Notepad++ |\n| 12dc1ea8e34b5a6 | Microsoft Paint |\n| 7e4dca80246863e3 | Control Panel |\n| 1cf97c38a5881255 | Microsoft Edge |\n| f01b4d95cf55d32a | Windows Explorer |\n| 9d1f905ce5044aee | Microsoft Excel |\n| a4a5324453625195 | Microsoft Word |\n| d00655d2aa12ff6d | Microsoft PowerPoint |\n| bc03160ee1a59fc1 | Outlook |\n\n### Custom Destinations (customDestinations-ms)\n\nCreated when users pin items to application jump lists. These files contain sequential LNK entries.\n\n## Python Analysis Script\n\n```python\nimport struct\nimport os\nfrom datetime import datetime, timedelta\n\nFILETIME_EPOCH = datetime(1601, 1, 1)\n\ndef filetime_to_datetime(filetime_bytes: bytes) -> datetime:\n    \"\"\"Convert Windows FILETIME (100-ns intervals since 1601) to datetime.\"\"\"\n    ft = struct.unpack(\"\u003CQ\", filetime_bytes)[0]\n    if ft == 0:\n        return None\n    return FILETIME_EPOCH + timedelta(microseconds=ft \u002F\u002F 10)\n\ndef parse_lnk_header(lnk_path: str) -> dict:\n    \"\"\"Parse the Shell Link header from an LNK file.\"\"\"\n    with open(lnk_path, \"rb\") as f:\n        header = f.read(76)\n\n    header_size = struct.unpack(\"\u003CI\", header[0:4])[0]\n    if header_size != 0x4C:\n        return {\"error\": \"Invalid LNK header\"}\n\n    link_flags = struct.unpack(\"\u003CI\", header[0x14:0x18])[0]\n    file_attrs = struct.unpack(\"\u003CI\", header[0x18:0x1C])[0]\n\n    result = {\n        \"header_size\": header_size,\n        \"link_flags\": hex(link_flags),\n        \"file_attributes\": hex(file_attrs),\n        \"creation_time\": filetime_to_datetime(header[0x1C:0x24]),\n        \"access_time\": filetime_to_datetime(header[0x24:0x2C]),\n        \"write_time\": filetime_to_datetime(header[0x2C:0x34]),\n        \"file_size\": struct.unpack(\"\u003CI\", header[0x34:0x38])[0],\n        \"has_target_id_list\": bool(link_flags & 0x01),\n        \"has_link_info\": bool(link_flags & 0x02),\n        \"has_name\": bool(link_flags & 0x04),\n        \"has_relative_path\": bool(link_flags & 0x08),\n        \"has_working_dir\": bool(link_flags & 0x10),\n        \"has_arguments\": bool(link_flags & 0x20),\n        \"has_icon_location\": bool(link_flags & 0x40),\n    }\n    return result\n```\n\n## Investigation Use Cases\n\n### Evidence of File Access\n1. Parse LNK files from Recent folder to identify accessed documents\n2. Cross-reference with MFT timestamps and USN Journal entries\n3. Note that LNK files persist even after target files are deleted\n\n### Removable Media Access\n1. LNK files referencing drive letters E:, F:, G: indicate removable media usage\n2. Volume serial number in LNK identifies the specific device\n3. MAC address in TrackerDataBlock identifies the source machine\n\n### Network Share Activity\n1. LNK files with UNC paths (\\\\server\\share) indicate network file access\n2. NetBIOS name identifies the remote server\n3. Timestamps establish when access occurred\n\n## Differences Between Windows 10 and Windows 11\n\nRecent research (IEEE 2025) shows that Windows 11 produces different LNK and Jump List artifacts:\n- Fewer automatic LNK files generated for certain file types\n- Modified Jump List behavior for modern applications\n- UWP\u002FMSIX applications may not generate traditional Jump Lists\n- Windows 11 Quick Access replaces some Recent functionality\n\n## References\n\n- Shell Link Binary File Format: https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fopenspecs\u002Fwindows_protocols\u002Fms-shllink\u002F\n- Magnet Forensics LNK Analysis: https:\u002F\u002Fwww.magnetforensics.com\u002Fblog\u002Fforensic-analysis-of-lnk-files\u002F\n- Jump Lists Forensics 2025: https:\u002F\u002Fwww.cybertriage.com\u002Fblog\u002Fjump-list-forensics-2025\u002F\n- Eric Zimmerman's LECmd\u002FJLECmd: https:\u002F\u002Fericzimmerman.github.io\u002F\n\n## Example Output\n\n```text\n$ LECmd.exe -d \"C:\\Evidence\\Users\\jsmith\\AppData\\Roaming\\Microsoft\\Windows\\Recent\" --csv \u002Fanalysis\u002Flnk_output\n\nLECmd v1.11.0 - LNK File Parser\n================================\n\nProcessing 47 LNK files...\n\n--- LNK File: Q4_Report.xlsx.lnk ---\n  Source:           C:\\Evidence\\Users\\jsmith\\Recent\\Q4_Report.xlsx.lnk\n  Target Path:      C:\\Users\\jsmith\\Downloads\\Q4_Report.xlsm\n  Target Created:   2024-01-15 14:33:45 UTC\n  Target Modified:  2024-01-15 14:33:45 UTC\n  Target Accessed:  2024-01-15 14:35:12 UTC\n  File Size:        251,904 bytes\n  Drive Type:       Fixed (C:)\n  Volume Serial:    A4E7-3F21\n  Machine ID:       DESKTOP-J5M1TH\n  MAC Address:      48:2A:E3:5C:9B:01\n\n--- LNK File: update_client.exe.lnk ---\n  Source:           C:\\Evidence\\Users\\jsmith\\Recent\\update_client.exe.lnk\n  Target Path:      C:\\ProgramData\\Updates\\update_client.exe\n  Target Created:   2024-01-15 14:34:02 UTC\n  Target Modified:  2024-01-15 14:34:02 UTC\n  Target Accessed:  2024-01-15 14:36:30 UTC\n  File Size:        1,258,496 bytes\n  Drive Type:       Fixed (C:)\n  Volume Serial:    A4E7-3F21\n  Machine ID:       DESKTOP-J5M1TH\n  Working Dir:      C:\\ProgramData\\Updates\n  Arguments:        --silent --no-update-check\n  Run Window:       Hidden\n\n======================================================================\n\n$ JLECmd.exe -d \"C:\\Evidence\\Users\\jsmith\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\" --csv \u002Fanalysis\u002Fjumplist_output\n\nJLECmd v1.5.0 - Jump List Parser\n==================================\n\nProcessing 23 AutomaticDestinations files...\n\n--- Application: Microsoft Excel (AppID: 12dc1ea8e34b5a6) ---\n  Entries: 15\n  Most Recent:\n    Entry 0:  C:\\Users\\jsmith\\Downloads\\Q4_Report.xlsm         (2024-01-15 14:35:12 UTC)\n    Entry 1:  \\\\FILESERV01\\Finance\\Budget_2024.xlsx             (2024-01-14 09:22:30 UTC)\n    Entry 2:  C:\\Users\\jsmith\\Documents\\Expenses\\Dec2023.xlsx   (2024-01-10 16:45:00 UTC)\n\n--- Application: Windows Explorer (AppID: f01b4d95cf55d32a) ---\n  Entries: 28\n  Most Recent:\n    Entry 0:  C:\\ProgramData\\Updates\\                           (2024-01-15 14:36:25 UTC)\n    Entry 1:  E:\\Backup\\                                        (2024-01-15 15:30:00 UTC)\n    Entry 2:  \\\\FILESERV01\\HR\\Employees\\                        (2024-01-15 16:12:45 UTC)\n\n--- Application: cmd.exe (AppID: 9b9cdc69c1c24e2b) ---\n  Entries: 5\n  Most Recent:\n    Entry 0:  C:\\Windows\\System32\\cmd.exe                       (2024-01-15 14:36:00 UTC)\n\nSummary:\n  Total LNK files processed:    47\n  Total Jump List entries:       156\n  Suspicious artifacts:          3 (hidden window execution, USB drive access, network shares)\n  CSV exported to:               \u002Fanalysis\u002Flnk_output\u002F and \u002Fanalysis\u002Fjumplist_output\u002F\n```\n",{"name":5,"tags":41,"author":42,"domain":35,"license":15,"version":43,"nist_csf":44,"subdomain":48,"description":7,"mitre_attack":49},[32,31,22,29,28,27,26,25,24,23],"mahipal","1.0",[45,46,47],"RS.AN-03","DE.AE-02","RS.MA-01","digital-forensics",[50,51,52],"T1547.009","T1204.002","T1059.001","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fanalyzing-lnk-file-and-jump-list-artifacts",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":64,"prompt":74,"zipAvailable":75},[65,68,71],{"tool":66,"command":67},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-lnk-file-and-jump-list-artifacts",{"tool":69,"command":70},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-lnk-file-and-jump-list-artifacts",{"tool":72,"command":73},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill analyzing-lnk-file-and-jump-list-artifacts","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002FSKILL.md",true,[77,83,89,93,97,102,106,110,114,118,124,128],{"path":78,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":82},"agents\u002Fopenai.yaml","REFERENCE","参考文档",306,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Fvercel-deploy\u002Fagents\u002Fopenai.yaml",{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"assets\u002Ftemplate.md","ASSET","资产文件",759,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002Fassets\u002Ftemplate.md",{"path":90,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":91,"sourceHtmlUrl":92},"assets\u002Fvercel-small.svg",243,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Fvercel-deploy\u002Fassets\u002Fvercel-small.svg",{"path":94,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":95,"sourceHtmlUrl":96},"assets\u002Fvercel.png",788,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Fvercel-deploy\u002Fassets\u002Fvercel.png",{"path":98,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":100,"sourceHtmlUrl":101},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002FLICENSE",{"path":103,"resourceType":98,"resourceTypeDesc":99,"sizeBytes":104,"sourceHtmlUrl":105},"LICENSE.txt",1063,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Fvercel-deploy\u002FLICENSE.txt",{"path":107,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":108,"sourceHtmlUrl":109},"references\u002Fapi-reference.md",3247,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002Freferences\u002Fapi-reference.md",{"path":111,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":112,"sourceHtmlUrl":113},"references\u002Fstandards.md",852,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002Freferences\u002Fstandards.md",{"path":115,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":116,"sourceHtmlUrl":117},"references\u002Fworkflows.md",952,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002Freferences\u002Fworkflows.md",{"path":119,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":122,"sourceHtmlUrl":123},"scripts\u002Fagent.py","SCRIPT","脚本",11370,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002Fscripts\u002Fagent.py",{"path":125,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":126,"sourceHtmlUrl":127},"scripts\u002Fdeploy.sh",8877,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Fvercel-deploy\u002Fscripts\u002Fdeploy.sh",{"path":129,"resourceType":120,"resourceTypeDesc":121,"sizeBytes":130,"sourceHtmlUrl":131},"scripts\u002Fprocess.py",3380,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002Fscripts\u002Fprocess.py",[133,163,187,215,238,265],{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":144,"publishedAt":36},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[139],{"categoryNo":140,"categoryName":141,"taxonomyType":142,"taxonomyTypeDesc":143},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[145,146,147,148,149,35,150,151,152,153,20,154,155,156,157,158,159,160,161,162],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","security","incident response","identity","pr","code","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":164,"name":165,"nameZh":6,"description":166,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":167,"categories":168,"keywords":170,"publishedAt":36},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[169],{"categoryNo":140,"categoryName":141,"taxonomyType":142,"taxonomyTypeDesc":143},[171,159,172,173,149,174,35,152,175,176,177,178,179,180,181,182,183,184,185,186],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":188,"name":189,"nameZh":6,"description":190,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":191,"categories":192,"keywords":197,"publishedAt":36},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[193,196],{"categoryNo":194,"categoryName":195,"taxonomyType":142,"taxonomyTypeDesc":143},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":140,"categoryName":141,"taxonomyType":142,"taxonomyTypeDesc":143},[181,198,199,200,201,35,202,203,175,204,205,206,207,208,209,210,211,212,213,214],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":216,"name":217,"nameZh":6,"description":218,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":219,"categories":220,"keywords":222,"publishedAt":36},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[221],{"categoryNo":140,"categoryName":141,"taxonomyType":142,"taxonomyTypeDesc":143},[34,223,224,35,225,226,227,28,228,229,230,231,232,233,48,234,178,235,236,237],"kape","triaging windows with kape","registry","browser","logs","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","SET","collection","pecmd","artifact-collection",{"skillNo":239,"name":240,"nameZh":6,"description":241,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":242,"categories":243,"keywords":245,"publishedAt":36},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[244],{"categoryNo":140,"categoryName":141,"taxonomyType":142,"taxonomyTypeDesc":143},[246,247,248,35,249,250,251,252,253,254,255,256,257,258,259,260,261,262,263,264],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":266,"name":267,"nameZh":6,"description":268,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":269,"categories":270,"keywords":272,"publishedAt":36},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[271],{"categoryNo":140,"categoryName":141,"taxonomyType":142,"taxonomyTypeDesc":143},[149,273,35,274,21,275,276,277,278,279,280,210,281,211,282,283,284,285,286,287],"triaging security incident","siem","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]