[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ER5ZDB3VHEVNEMWMAS2Q2A":3,"skill-same:01M6ER5ZDB3VHEVNEMWMAS2Q2A":105},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":48,"commitSha":49,"skillDirectory":50,"forksCount":51,"repositoryHtmlUrl":52,"repositoryHomepageUrl":6,"ownerHtmlUrl":53,"ownerBlogUrl":6,"ownerDescription":54,"updatedAt":55,"install":56,"resources":69},"01M6ER5ZDB3VHEVNEMWMAS2Q2A","analyzing-lnk-file-and-jump-list-artifacts",null,"Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.","luokai0\u002Fai-agent-skills-by-luo-kai","luokai0","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F266954973?v=4","01M6E16VNT42JB8B3X3254QWJ7","luo kai","01M6E16VTFVP6S5XJF1V1MPV90",14,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"artifacts","file","list","analyzing","analyzing lnk file and jump list artifacts","user-activity","files","analyze","access","recent-files","program-execution","file-access","file access","shell-link","windows-forensics","jlecmd","lecmd","jump-lists","lnk-files","cybersecurity","2026-11-10 10:12:30",false,"---\nname: analyzing-lnk-file-and-jump-list-artifacts\ndescription: Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags: [lnk-files, jump-lists, lecmd, jlecmd, windows-forensics, shell-link, user-activity, file-access, program-execution, recent-files]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Analyzing LNK File and Jump List Artifacts\n\n## Overview\n\nWindows LNK (shortcut) files and Jump Lists are critical forensic artifacts that provide evidence of file access, program execution, and user behavior. LNK files are created automatically when a user opens a file through Windows Explorer or the Open\u002FSave dialog, storing metadata about the target file including its original path, timestamps, volume serial number, NetBIOS name, and MAC address of the host system. Jump Lists, introduced in Windows 7, extend this by maintaining per-application lists of recently and frequently accessed files. These artifacts persist even after the target files are deleted, making them invaluable for establishing that a user accessed specific files at specific times.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing lnk file and jump list artifacts\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- LECmd (Eric Zimmerman) for LNK file parsing\n- JLECmd (Eric Zimmerman) for Jump List parsing\n- Python 3.8+ with pylnk3 or LnkParse3 libraries\n- Forensic image or triage collection from Windows system\n- Timeline Explorer for CSV analysis\n\n## LNK File Locations\n\n| Location | Description |\n|----------|-------------|\n| `%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\` | Recent files accessed |\n| `%USERPROFILE%\\Desktop\\` | User-created shortcuts |\n| `%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\` | Start Menu shortcuts |\n| `%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\` | Office recent documents |\n\n## LNK File Structure\n\n### Shell Link Header (76 bytes)\n\n| Offset | Size | Field |\n|--------|------|-------|\n| 0x00 | 4 | HeaderSize (always 0x0000004C) |\n| 0x04 | 16 | LinkCLSID (always 00021401-0000-0000-C000-000000000046) |\n| 0x14 | 4 | LinkFlags |\n| 0x18 | 4 | FileAttributes |\n| 0x1C | 8 | CreationTime (FILETIME) |\n| 0x24 | 8 | AccessTime (FILETIME) |\n| 0x2C | 8 | WriteTime (FILETIME) |\n| 0x34 | 4 | FileSize of target |\n| 0x38 | 4 | IconIndex |\n| 0x3C | 4 | ShowCommand |\n| 0x40 | 2 | HotKey |\n\n### Key Forensic Fields in LNK Files\n\n- **Target file timestamps**: Creation, access, modification times of the referenced file\n- **Volume information**: Serial number, drive type, volume label\n- **Network share information**: UNC path, share name\n- **Machine identifiers**: NetBIOS name, MAC address (from TrackerDataBlock)\n- **Distributed Link Tracking**: Machine ID and object GUID\n\n## Analysis with EZ Tools\n\n### LECmd - LNK File Parser\n\n```powershell\n# Parse all LNK files in Recent folder\nLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\" --csv C:\\Output --csvf lnk_analysis.csv\n\n# Parse a single LNK file with full details\nLECmd.exe -f \"C:\\Evidence\\Users\\suspect\\Desktop\\Confidential.docx.lnk\" --json C:\\Output\n\n# Parse LNK files with additional detail levels\nLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\" --csv C:\\Output --csvf lnk_all.csv --all\n```\n\n### JLECmd - Jump List Parser\n\n```powershell\n# Parse Automatic Jump Lists\nJLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\" --csv C:\\Output --csvf jumplists_auto.csv\n\n# Parse Custom Jump Lists\nJLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\" --csv C:\\Output --csvf jumplists_custom.csv\n\n# Parse all jump lists with detailed output\nJLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\" --csv C:\\Output --csvf jumplists_auto.csv --ld\n```\n\n## Jump List Structure\n\n### Automatic Destinations (automaticDestinations-ms)\n\nThese are OLE Compound files (Structured Storage) identified by AppID hash in the filename:\n\n| AppID Hash | Application |\n|-----------|-------------|\n| 5f7b5f1e01b83767 | Windows Explorer Pinned\u002FFrequent |\n| 1b4dd67f29cb1962 | Windows Explorer Recent |\n| 9b9cdc69c1c24e2b | Notepad |\n| a7bd71699cd38d1c | Notepad++ |\n| 12dc1ea8e34b5a6 | Microsoft Paint |\n| 7e4dca80246863e3 | Control Panel |\n| 1cf97c38a5881255 | Microsoft Edge |\n| f01b4d95cf55d32a | Windows Explorer |\n| 9d1f905ce5044aee | Microsoft Excel |\n| a4a5324453625195 | Microsoft Word |\n| d00655d2aa12ff6d | Microsoft PowerPoint |\n| bc03160ee1a59fc1 | Outlook |\n\n### Custom Destinations (customDestinations-ms)\n\nCreated when users pin items to application jump lists. These files contain sequential LNK entries.\n\n## Python Analysis Script\n\n```python\nimport struct\nimport os\nfrom datetime import datetime, timedelta\n\nFILETIME_EPOCH = datetime(1601, 1, 1)\n\ndef filetime_to_datetime(filetime_bytes: bytes) -> datetime:\n    \"\"\"Convert Windows FILETIME (100-ns intervals since 1601) to datetime.\"\"\"\n    ft = struct.unpack(\"\u003CQ\", filetime_bytes)[0]\n    if ft == 0:\n        return None\n    return FILETIME_EPOCH + timedelta(microseconds=ft \u002F\u002F 10)\n\ndef parse_lnk_header(lnk_path: str) -> dict:\n    \"\"\"Parse the Shell Link header from an LNK file.\"\"\"\n    with open(lnk_path, \"rb\") as f:\n        header = f.read(76)\n\n    header_size = struct.unpack(\"\u003CI\", header[0:4])[0]\n    if header_size != 0x4C:\n        return {\"error\": \"Invalid LNK header\"}\n\n    link_flags = struct.unpack(\"\u003CI\", header[0x14:0x18])[0]\n    file_attrs = struct.unpack(\"\u003CI\", header[0x18:0x1C])[0]\n\n    result = {\n        \"header_size\": header_size,\n        \"link_flags\": hex(link_flags),\n        \"file_attributes\": hex(file_attrs),\n        \"creation_time\": filetime_to_datetime(header[0x1C:0x24]),\n        \"access_time\": filetime_to_datetime(header[0x24:0x2C]),\n        \"write_time\": filetime_to_datetime(header[0x2C:0x34]),\n        \"file_size\": struct.unpack(\"\u003CI\", header[0x34:0x38])[0],\n        \"has_target_id_list\": bool(link_flags & 0x01),\n        \"has_link_info\": bool(link_flags & 0x02),\n        \"has_name\": bool(link_flags & 0x04),\n        \"has_relative_path\": bool(link_flags & 0x08),\n        \"has_working_dir\": bool(link_flags & 0x10),\n        \"has_arguments\": bool(link_flags & 0x20),\n        \"has_icon_location\": bool(link_flags & 0x40),\n    }\n    return result\n```\n\n## Investigation Use Cases\n\n### Evidence of File Access\n1. Parse LNK files from Recent folder to identify accessed documents\n2. Cross-reference with MFT timestamps and USN Journal entries\n3. Note that LNK files persist even after target files are deleted\n\n### Removable Media Access\n1. LNK files referencing drive letters E:, F:, G: indicate removable media usage\n2. Volume serial number in LNK identifies the specific device\n3. MAC address in TrackerDataBlock identifies the source machine\n\n### Network Share Activity\n1. LNK files with UNC paths (\\\\server\\share) indicate network file access\n2. NetBIOS name identifies the remote server\n3. Timestamps establish when access occurred\n\n## Differences Between Windows 10 and Windows 11\n\nRecent research (IEEE 2025) shows that Windows 11 produces different LNK and Jump List artifacts:\n- Fewer automatic LNK files generated for certain file types\n- Modified Jump List behavior for modern applications\n- UWP\u002FMSIX applications may not generate traditional Jump Lists\n- Windows 11 Quick Access replaces some Recent functionality\n\n## References\n\n- Shell Link Binary File Format: https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fopenspecs\u002Fwindows_protocols\u002Fms-shllink\u002F\n- Magnet Forensics LNK Analysis: https:\u002F\u002Fwww.magnetforensics.com\u002Fblog\u002Fforensic-analysis-of-lnk-files\u002F\n- Jump Lists Forensics 2025: https:\u002F\u002Fwww.cybertriage.com\u002Fblog\u002Fjump-list-forensics-2025\u002F\n- Eric Zimmerman's LECmd\u002FJLECmd: https:\u002F\u002Fericzimmerman.github.io\u002F\n\n## Example Output\n\n```text\n$ LECmd.exe -d \"C:\\Evidence\\Users\\jsmith\\AppData\\Roaming\\Microsoft\\Windows\\Recent\" --csv \u002Fanalysis\u002Flnk_output\n\nLECmd v1.11.0 - LNK File Parser\n================================\n\nProcessing 47 LNK files...\n\n--- LNK File: Q4_Report.xlsx.lnk ---\n  Source:           C:\\Evidence\\Users\\jsmith\\Recent\\Q4_Report.xlsx.lnk\n  Target Path:      C:\\Users\\jsmith\\Downloads\\Q4_Report.xlsm\n  Target Created:   2024-01-15 14:33:45 UTC\n  Target Modified:  2024-01-15 14:33:45 UTC\n  Target Accessed:  2024-01-15 14:35:12 UTC\n  File Size:        251,904 bytes\n  Drive Type:       Fixed (C:)\n  Volume Serial:    A4E7-3F21\n  Machine ID:       DESKTOP-J5M1TH\n  MAC Address:      48:2A:E3:5C:9B:01\n\n--- LNK File: update_client.exe.lnk ---\n  Source:           C:\\Evidence\\Users\\jsmith\\Recent\\update_client.exe.lnk\n  Target Path:      C:\\ProgramData\\Updates\\update_client.exe\n  Target Created:   2024-01-15 14:34:02 UTC\n  Target Modified:  2024-01-15 14:34:02 UTC\n  Target Accessed:  2024-01-15 14:36:30 UTC\n  File Size:        1,258,496 bytes\n  Drive Type:       Fixed (C:)\n  Volume Serial:    A4E7-3F21\n  Machine ID:       DESKTOP-J5M1TH\n  Working Dir:      C:\\ProgramData\\Updates\n  Arguments:        --silent --no-update-check\n  Run Window:       Hidden\n\n======================================================================\n\n$ JLECmd.exe -d \"C:\\Evidence\\Users\\jsmith\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\" --csv \u002Fanalysis\u002Fjumplist_output\n\nJLECmd v1.5.0 - Jump List Parser\n==================================\n\nProcessing 23 AutomaticDestinations files...\n\n--- Application: Microsoft Excel (AppID: 12dc1ea8e34b5a6) ---\n  Entries: 15\n  Most Recent:\n    Entry 0:  C:\\Users\\jsmith\\Downloads\\Q4_Report.xlsm         (2024-01-15 14:35:12 UTC)\n    Entry 1:  \\\\FILESERV01\\Finance\\Budget_2024.xlsx             (2024-01-14 09:22:30 UTC)\n    Entry 2:  C:\\Users\\jsmith\\Documents\\Expenses\\Dec2023.xlsx   (2024-01-10 16:45:00 UTC)\n\n--- Application: Windows Explorer (AppID: f01b4d95cf55d32a) ---\n  Entries: 28\n  Most Recent:\n    Entry 0:  C:\\ProgramData\\Updates\\                           (2024-01-15 14:36:25 UTC)\n    Entry 1:  E:\\Backup\\                                        (2024-01-15 15:30:00 UTC)\n    Entry 2:  \\\\FILESERV01\\HR\\Employees\\                        (2024-01-15 16:12:45 UTC)\n\n--- Application: cmd.exe (AppID: 9b9cdc69c1c24e2b) ---\n  Entries: 5\n  Most Recent:\n    Entry 0:  C:\\Windows\\System32\\cmd.exe                       (2024-01-15 14:36:00 UTC)\n\nSummary:\n  Total LNK files processed:    47\n  Total Jump List entries:       156\n  Suspicious artifacts:          3 (hidden window execution, USB drive access, network shares)\n  CSV exported to:               \u002Fanalysis\u002Flnk_output\u002F and \u002Fanalysis\u002Fjumplist_output\u002F\n```\n","# Analyzing LNK File and Jump List Artifacts\n\n## Overview\n\nWindows LNK (shortcut) files and Jump Lists are critical forensic artifacts that provide evidence of file access, program execution, and user behavior. LNK files are created automatically when a user opens a file through Windows Explorer or the Open\u002FSave dialog, storing metadata about the target file including its original path, timestamps, volume serial number, NetBIOS name, and MAC address of the host system. Jump Lists, introduced in Windows 7, extend this by maintaining per-application lists of recently and frequently accessed files. These artifacts persist even after the target files are deleted, making them invaluable for establishing that a user accessed specific files at specific times.\n\n\n## When to Use\n\n- When investigating security incidents that require analyzing lnk file and jump list artifacts\n- When building detection rules or threat hunting queries for this domain\n- When SOC analysts need structured procedures for this analysis type\n- When validating security monitoring coverage for related attack techniques\n\n## Prerequisites\n\n- LECmd (Eric Zimmerman) for LNK file parsing\n- JLECmd (Eric Zimmerman) for Jump List parsing\n- Python 3.8+ with pylnk3 or LnkParse3 libraries\n- Forensic image or triage collection from Windows system\n- Timeline Explorer for CSV analysis\n\n## LNK File Locations\n\n| Location | Description |\n|----------|-------------|\n| `%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\` | Recent files accessed |\n| `%USERPROFILE%\\Desktop\\` | User-created shortcuts |\n| `%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\` | Start Menu shortcuts |\n| `%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Office\\Recent\\` | Office recent documents |\n\n## LNK File Structure\n\n### Shell Link Header (76 bytes)\n\n| Offset | Size | Field |\n|--------|------|-------|\n| 0x00 | 4 | HeaderSize (always 0x0000004C) |\n| 0x04 | 16 | LinkCLSID (always 00021401-0000-0000-C000-000000000046) |\n| 0x14 | 4 | LinkFlags |\n| 0x18 | 4 | FileAttributes |\n| 0x1C | 8 | CreationTime (FILETIME) |\n| 0x24 | 8 | AccessTime (FILETIME) |\n| 0x2C | 8 | WriteTime (FILETIME) |\n| 0x34 | 4 | FileSize of target |\n| 0x38 | 4 | IconIndex |\n| 0x3C | 4 | ShowCommand |\n| 0x40 | 2 | HotKey |\n\n### Key Forensic Fields in LNK Files\n\n- **Target file timestamps**: Creation, access, modification times of the referenced file\n- **Volume information**: Serial number, drive type, volume label\n- **Network share information**: UNC path, share name\n- **Machine identifiers**: NetBIOS name, MAC address (from TrackerDataBlock)\n- **Distributed Link Tracking**: Machine ID and object GUID\n\n## Analysis with EZ Tools\n\n### LECmd - LNK File Parser\n\n```powershell\n# Parse all LNK files in Recent folder\nLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\" --csv C:\\Output --csvf lnk_analysis.csv\n\n# Parse a single LNK file with full details\nLECmd.exe -f \"C:\\Evidence\\Users\\suspect\\Desktop\\Confidential.docx.lnk\" --json C:\\Output\n\n# Parse LNK files with additional detail levels\nLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\" --csv C:\\Output --csvf lnk_all.csv --all\n```\n\n### JLECmd - Jump List Parser\n\n```powershell\n# Parse Automatic Jump Lists\nJLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\" --csv C:\\Output --csvf jumplists_auto.csv\n\n# Parse Custom Jump Lists\nJLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\" --csv C:\\Output --csvf jumplists_custom.csv\n\n# Parse all jump lists with detailed output\nJLECmd.exe -d \"C:\\Evidence\\Users\\suspect\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\" --csv C:\\Output --csvf jumplists_auto.csv --ld\n```\n\n## Jump List Structure\n\n### Automatic Destinations (automaticDestinations-ms)\n\nThese are OLE Compound files (Structured Storage) identified by AppID hash in the filename:\n\n| AppID Hash | Application |\n|-----------|-------------|\n| 5f7b5f1e01b83767 | Windows Explorer Pinned\u002FFrequent |\n| 1b4dd67f29cb1962 | Windows Explorer Recent |\n| 9b9cdc69c1c24e2b | Notepad |\n| a7bd71699cd38d1c | Notepad++ |\n| 12dc1ea8e34b5a6 | Microsoft Paint |\n| 7e4dca80246863e3 | Control Panel |\n| 1cf97c38a5881255 | Microsoft Edge |\n| f01b4d95cf55d32a | Windows Explorer |\n| 9d1f905ce5044aee | Microsoft Excel |\n| a4a5324453625195 | Microsoft Word |\n| d00655d2aa12ff6d | Microsoft PowerPoint |\n| bc03160ee1a59fc1 | Outlook |\n\n### Custom Destinations (customDestinations-ms)\n\nCreated when users pin items to application jump lists. These files contain sequential LNK entries.\n\n## Python Analysis Script\n\n```python\nimport struct\nimport os\nfrom datetime import datetime, timedelta\n\nFILETIME_EPOCH = datetime(1601, 1, 1)\n\ndef filetime_to_datetime(filetime_bytes: bytes) -> datetime:\n    \"\"\"Convert Windows FILETIME (100-ns intervals since 1601) to datetime.\"\"\"\n    ft = struct.unpack(\"\u003CQ\", filetime_bytes)[0]\n    if ft == 0:\n        return None\n    return FILETIME_EPOCH + timedelta(microseconds=ft \u002F\u002F 10)\n\ndef parse_lnk_header(lnk_path: str) -> dict:\n    \"\"\"Parse the Shell Link header from an LNK file.\"\"\"\n    with open(lnk_path, \"rb\") as f:\n        header = f.read(76)\n\n    header_size = struct.unpack(\"\u003CI\", header[0:4])[0]\n    if header_size != 0x4C:\n        return {\"error\": \"Invalid LNK header\"}\n\n    link_flags = struct.unpack(\"\u003CI\", header[0x14:0x18])[0]\n    file_attrs = struct.unpack(\"\u003CI\", header[0x18:0x1C])[0]\n\n    result = {\n        \"header_size\": header_size,\n        \"link_flags\": hex(link_flags),\n        \"file_attributes\": hex(file_attrs),\n        \"creation_time\": filetime_to_datetime(header[0x1C:0x24]),\n        \"access_time\": filetime_to_datetime(header[0x24:0x2C]),\n        \"write_time\": filetime_to_datetime(header[0x2C:0x34]),\n        \"file_size\": struct.unpack(\"\u003CI\", header[0x34:0x38])[0],\n        \"has_target_id_list\": bool(link_flags & 0x01),\n        \"has_link_info\": bool(link_flags & 0x02),\n        \"has_name\": bool(link_flags & 0x04),\n        \"has_relative_path\": bool(link_flags & 0x08),\n        \"has_working_dir\": bool(link_flags & 0x10),\n        \"has_arguments\": bool(link_flags & 0x20),\n        \"has_icon_location\": bool(link_flags & 0x40),\n    }\n    return result\n```\n\n## Investigation Use Cases\n\n### Evidence of File Access\n1. Parse LNK files from Recent folder to identify accessed documents\n2. Cross-reference with MFT timestamps and USN Journal entries\n3. Note that LNK files persist even after target files are deleted\n\n### Removable Media Access\n1. LNK files referencing drive letters E:, F:, G: indicate removable media usage\n2. Volume serial number in LNK identifies the specific device\n3. MAC address in TrackerDataBlock identifies the source machine\n\n### Network Share Activity\n1. LNK files with UNC paths (\\\\server\\share) indicate network file access\n2. NetBIOS name identifies the remote server\n3. Timestamps establish when access occurred\n\n## Differences Between Windows 10 and Windows 11\n\nRecent research (IEEE 2025) shows that Windows 11 produces different LNK and Jump List artifacts:\n- Fewer automatic LNK files generated for certain file types\n- Modified Jump List behavior for modern applications\n- UWP\u002FMSIX applications may not generate traditional Jump Lists\n- Windows 11 Quick Access replaces some Recent functionality\n\n## References\n\n- Shell Link Binary File Format: https:\u002F\u002Fdocs.microsoft.com\u002Fen-us\u002Fopenspecs\u002Fwindows_protocols\u002Fms-shllink\u002F\n- Magnet Forensics LNK Analysis: https:\u002F\u002Fwww.magnetforensics.com\u002Fblog\u002Fforensic-analysis-of-lnk-files\u002F\n- Jump Lists Forensics 2025: https:\u002F\u002Fwww.cybertriage.com\u002Fblog\u002Fjump-list-forensics-2025\u002F\n- Eric Zimmerman's LECmd\u002FJLECmd: https:\u002F\u002Fericzimmerman.github.io\u002F\n\n## Example Output\n\n```text\n$ LECmd.exe -d \"C:\\Evidence\\Users\\jsmith\\AppData\\Roaming\\Microsoft\\Windows\\Recent\" --csv \u002Fanalysis\u002Flnk_output\n\nLECmd v1.11.0 - LNK File Parser\n================================\n\nProcessing 47 LNK files...\n\n--- LNK File: Q4_Report.xlsx.lnk ---\n  Source:           C:\\Evidence\\Users\\jsmith\\Recent\\Q4_Report.xlsx.lnk\n  Target Path:      C:\\Users\\jsmith\\Downloads\\Q4_Report.xlsm\n  Target Created:   2024-01-15 14:33:45 UTC\n  Target Modified:  2024-01-15 14:33:45 UTC\n  Target Accessed:  2024-01-15 14:35:12 UTC\n  File Size:        251,904 bytes\n  Drive Type:       Fixed (C:)\n  Volume Serial:    A4E7-3F21\n  Machine ID:       DESKTOP-J5M1TH\n  MAC Address:      48:2A:E3:5C:9B:01\n\n--- LNK File: update_client.exe.lnk ---\n  Source:           C:\\Evidence\\Users\\jsmith\\Recent\\update_client.exe.lnk\n  Target Path:      C:\\ProgramData\\Updates\\update_client.exe\n  Target Created:   2024-01-15 14:34:02 UTC\n  Target Modified:  2024-01-15 14:34:02 UTC\n  Target Accessed:  2024-01-15 14:36:30 UTC\n  File Size:        1,258,496 bytes\n  Drive Type:       Fixed (C:)\n  Volume Serial:    A4E7-3F21\n  Machine ID:       DESKTOP-J5M1TH\n  Working Dir:      C:\\ProgramData\\Updates\n  Arguments:        --silent --no-update-check\n  Run Window:       Hidden\n\n======================================================================\n\n$ JLECmd.exe -d \"C:\\Evidence\\Users\\jsmith\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\AutomaticDestinations\" --csv \u002Fanalysis\u002Fjumplist_output\n\nJLECmd v1.5.0 - Jump List Parser\n==================================\n\nProcessing 23 AutomaticDestinations files...\n\n--- Application: Microsoft Excel (AppID: 12dc1ea8e34b5a6) ---\n  Entries: 15\n  Most Recent:\n    Entry 0:  C:\\Users\\jsmith\\Downloads\\Q4_Report.xlsm         (2024-01-15 14:35:12 UTC)\n    Entry 1:  \\\\FILESERV01\\Finance\\Budget_2024.xlsx             (2024-01-14 09:22:30 UTC)\n    Entry 2:  C:\\Users\\jsmith\\Documents\\Expenses\\Dec2023.xlsx   (2024-01-10 16:45:00 UTC)\n\n--- Application: Windows Explorer (AppID: f01b4d95cf55d32a) ---\n  Entries: 28\n  Most Recent:\n    Entry 0:  C:\\ProgramData\\Updates\\                           (2024-01-15 14:36:25 UTC)\n    Entry 1:  E:\\Backup\\                                        (2024-01-15 15:30:00 UTC)\n    Entry 2:  \\\\FILESERV01\\HR\\Employees\\                        (2024-01-15 16:12:45 UTC)\n\n--- Application: cmd.exe (AppID: 9b9cdc69c1c24e2b) ---\n  Entries: 5\n  Most Recent:\n    Entry 0:  C:\\Windows\\System32\\cmd.exe                       (2024-01-15 14:36:00 UTC)\n\nSummary:\n  Total LNK files processed:    47\n  Total Jump List entries:       156\n  Suspicious artifacts:          3 (hidden window execution, USB drive access, network shares)\n  CSV exported to:               \u002Fanalysis\u002Flnk_output\u002F and \u002Fanalysis\u002Fjumplist_output\u002F\n```\n",{"name":5,"tags":44,"author":45,"domain":38,"license":15,"version":46,"subdomain":47,"description":7},[37,36,35,34,33,32,24,30,29,28],"mahipal","1.0","digital-forensics","main","4d2fb89cdfb75f3f6fd3c6c5ec9ad90ea129eb3c","ai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-lnk-file-and-jump-list-artifacts",2,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai","https:\u002F\u002Fgithub.com\u002Fluokai0","a solo builder.","2026-05-06 04:29:04",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill analyzing-lnk-file-and-jump-list-artifacts",{"tool":62,"command":63},"bunx","bunx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill analyzing-lnk-file-and-jump-list-artifacts",{"tool":65,"command":66},"pnpm","pnpm dlx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill analyzing-lnk-file-and-jump-list-artifacts","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002FSKILL.md",true,[70,76,81,87,91,95,101],{"path":71,"resourceType":72,"resourceTypeDesc":73,"sizeBytes":74,"sourceHtmlUrl":75},"assets\u002Ftemplate.md","ASSET","资产文件",759,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002Fassets\u002Ftemplate.md",{"path":77,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002FLICENSE",{"path":82,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":85,"sourceHtmlUrl":86},"references\u002Fapi-reference.md","REFERENCE","参考文档",3247,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002Freferences\u002Fapi-reference.md",{"path":88,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":89,"sourceHtmlUrl":90},"references\u002Fstandards.md",852,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002Freferences\u002Fstandards.md",{"path":92,"resourceType":83,"resourceTypeDesc":84,"sizeBytes":93,"sourceHtmlUrl":94},"references\u002Fworkflows.md",952,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002Freferences\u002Fworkflows.md",{"path":96,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":99,"sourceHtmlUrl":100},"scripts\u002Fagent.py","SCRIPT","脚本",11370,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002Fscripts\u002Fagent.py",{"path":102,"resourceType":97,"resourceTypeDesc":98,"sizeBytes":103,"sourceHtmlUrl":104},"scripts\u002Fprocess.py",3380,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fanalyzing-lnk-file-and-jump-list-artifacts\u002Fscripts\u002Fprocess.py",[106,134,151,181,214,251],{"skillNo":107,"name":108,"nameZh":6,"description":109,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":111,"categories":112,"keywords":113,"publishedAt":39},"01M6F2SKTE208174C7S7JJCZC7","write-contracts","Generates secure Aptos Move V2 smart contracts with Object model, Digital Asset integration, security patterns, and storage type guidance. Includes comprehensive storage decision framework for optimal data structure selection. Triggers on: 'write contract', 'create NFT collection', 'build marketplace', 'implement minting', 'generate Move module', 'create token contract', 'build DAO', 'implement staking'. Ask storage questions when: 'store', 'track', 'registry', 'mapping', 'list', 'collection'.","MIT","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fwrite-contracts\u002FSKILL.md",[],[114,115,116,117,118,119,120,121,122,123,124,125,126,127,128,129,130,131,132,133],"write","contracts","write contracts","storage","secure","create","generate","collection","model","decision","ask","smart-contracts","selection","objects","structure","nft","token","aptos","critical","move",{"skillNo":135,"name":136,"nameZh":6,"description":137,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":138,"categories":139,"keywords":140,"publishedAt":39},"01M6F2RFXJ6T9MKW0A7N7GM45B","web-search","通用网络搜索技能，支持多引擎搜索（百度、必应、DuckDuckGo），无需API密钥即可获取实时信息","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fweb-search-ex-skill\u002FSKILL.md",[],[141,142,143,144,145,146,147,148,149,150],"web","search","web search","搜索","baidu","bing","duckduckgo","百度","多引擎","internet",{"skillNo":152,"name":153,"nameZh":6,"description":154,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":155,"categories":156,"keywords":162,"publishedAt":39},"01M6F2K968G1FZEZFPW2E6B222","solo-build","Execute implementation plan tasks with TDD workflow, auto-commit, and phase gates. Use when user says \"build it\", \"start building\", \"execute plan\", \"implement tasks\", \"ship it\", or references a track ID. Do NOT use for planning (use \u002Fplan) or scaffolding (use \u002Fscaffold).","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fsolo-build\u002FSKILL.md",[157],{"categoryNo":158,"categoryName":159,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[163,164,165,166,167,168,169,170,142,171,172,173,114,174,175,176,177,178,179,180],"build","solo","solo build","MCP","workflow","commit","tasks","code","Bash","plan","read","auto","references","context7","query","scaffolding","ship it","project",{"skillNo":182,"name":183,"nameZh":6,"description":184,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":185,"categories":186,"keywords":193,"publishedAt":39},"01M6F2GKN39SGHSPWYB3662YC8","react-email","Use when building HTML email templates with React components, adding a visual email editor to an application using the React Email visual editor, rendering emails to HTML, or sending emails with Resend. Covers welcome emails, password resets, notifications, order confirmations, newsletters, transactional emails, and the embeddable email editor component.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Freact-email-skills\u002FSKILL.md",[187,190],{"categoryNo":188,"categoryName":189,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":191,"categoryName":192,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000009","前端开发",[194,195,196,197,198,199,200,201,202,203,204,205,206,207,208,209,210,211,212,213],"react","email","react email","github","editor","components","react components","component","welcome","https","notifications","password","node","use","html","resend","visual","emails","rendering","with",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":218,"categories":219,"keywords":232,"publishedAt":39},"01M6F2FBVGVDFSG8SSFJGXA40C","APITester Agent-Driven API Testing","Test API endpoints and document responses. Define tests in plain English, run them, get formatted results. Agent-driven Postman alternative.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fopenclaw-api-tester\u002FSKILL.md",[220,223,226,227],{"categoryNo":221,"categoryName":222,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":224,"categoryName":225,"taxonomyType":160,"taxonomyTypeDesc":161},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":158,"categoryName":159,"taxonomyType":160,"taxonomyTypeDesc":161},{"categoryNo":228,"categoryName":229,"taxonomyType":230,"taxonomyTypeDesc":231},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[233,234,235,236,237,238,239,240,241,242,243,244,245,246,247,248,249,250],"testing","api","api testing","driven","APITester Agent Driven API Testing","test","run","postman","results","plain english","tester","endpoints","document","get","define","tests","english","api-tester",{"skillNo":252,"name":253,"nameZh":6,"description":254,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":110,"licenseFileUrl":6,"sourceHtmlUrl":255,"categories":256,"keywords":257,"publishedAt":39},"01M6F273Y3NGAPVJZ608BC0G9G","hubspot-implementation-plan","Generate a phased implementation plan from a HubSpot audit report. Creates prioritized, sequenced cleanup processes with effort estimates, dependencies, and automation feasibility. Use after running \u002Fhubspot-audit.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fhubspot-implementation-plan\u002FSKILL.md",[],[172,258,259,260,261,262,263,120,264,265,266,267,268,207,269,270,213,271],"implementation","hubspot","hubspot implementation plan","automation","feasibility","cleanup","planning","report","audit","audit report","phased implementation","dependencies","processes","hubspot audit"]