[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EST52K0KHZ69CTB5B9C2YS":3,"skill-same:01M6EST52K0KHZ69CTB5B9C2YS":113},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":64,"commitSha":65,"skillDirectory":66,"forksCount":14,"repositoryHtmlUrl":67,"repositoryHomepageUrl":68,"ownerHtmlUrl":69,"ownerBlogUrl":6,"ownerDescription":70,"updatedAt":71,"install":72,"resources":85},"01M6EST52K0KHZ69CTB5B9C2YS","analyzing-windows-lnk-files-for-artifacts",null,"Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.","henriquescastilho\u002Fmy-claude","henriquescastilho","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F153296945?v=4","01M6ESH7EXPXTH9CVQ4K16SRG8","Henrique Scheer","01M6ESH7JHEK2PTNNH4HEH787Z",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-windows-lnk-files-for-artifacts\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"windows","artifacts","analyzing","analyzing windows lnk files for artifacts","files","information","cybersecurity","machine","paths","de","volume","evidence","analysis","collection","T1547.001","shortcut-analysis","evidence-collection","windows-artifacts","lnk-files","forensics","2026-11-10 10:12:30",false,"---\nname: analyzing-windows-lnk-files-for-artifacts\ndescription: Parse Windows LNK shortcut files to extract target paths, timestamps,\n  volume information, and machine identifiers for forensic timeline reconstruction.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags:\n- forensics\n- lnk-files\n- windows-artifacts\n- shortcut-analysis\n- timeline-reconstruction\n- evidence-collection\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- RS.AN-01\n- RS.AN-03\n- DE.AE-02\n- RS.MA-01\nmitre_attack:\n- T1547.001\n- T1204.002\n- T1005\n- T1025\n- T1074.001\n---\n\n# Analyzing Windows LNK Files for Artifacts\n\n## When to Use\n- When reconstructing user file access history from Windows shortcut files\n- For tracking accessed files, network shares, and removable media\n- During investigations to prove a user opened specific documents\n- When correlating file access with other timeline artifacts\n- For identifying accessed paths on remote systems or USB devices\n\n## Prerequisites\n- Access to LNK files from forensic image (Recent, Desktop, Quick Launch)\n- LECmd (Eric Zimmerman), python-lnk, or LnkParser for analysis\n- Understanding of LNK file structure (Shell Link Binary format)\n- Knowledge of LNK file locations on Windows systems\n- Forensic workstation with analysis tools installed\n\n## Workflow\n\n### Step 1: Collect LNK Files from Forensic Image\n\n```bash\n# Mount forensic image\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Flnk\u002F{recent,desktop,startup,custom}\n\n# Copy Recent items LNK files (primary source)\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FRecent\u002F*.lnk \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F 2>\u002Fdev\u002Fnull\n\n# Copy automatic destinations (Jump Lists)\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FRecent\u002FAutomaticDestinations\u002F*.automaticDestinations-ms \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F 2>\u002Fdev\u002Fnull\n\n# Copy custom destinations (pinned Jump List items)\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FRecent\u002FCustomDestinations\u002F*.customDestinations-ms \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fcustom\u002F 2>\u002Fdev\u002Fnull\n\n# Copy Desktop shortcuts\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FDesktop\u002F*.lnk \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fdesktop\u002F 2>\u002Fdev\u002Fnull\n\n# Copy Startup folder shortcuts (persistence)\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FStart\\ Menu\u002FPrograms\u002FStartup\u002F*.lnk \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fstartup\u002F 2>\u002Fdev\u002Fnull\ncp \"\u002Fmnt\u002Fevidence\u002FProgramData\u002FMicrosoft\u002FWindows\u002FStart Menu\u002FPrograms\u002FStartup\"\u002F*.lnk \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fstartup\u002F 2>\u002Fdev\u002Fnull\n\n# Find all LNK files on the system\nfind \u002Fmnt\u002Fevidence\u002F -name \"*.lnk\" -type f 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fall_lnk_locations.txt\n\n# Count and hash\nls \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F | wc -l\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F*.lnk > \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Flnk_hashes.txt 2>\u002Fdev\u002Fnull\n```\n\n### Step 2: Parse LNK Files with LECmd\n\n```bash\n# Using Eric Zimmerman's LECmd (Windows or via Mono)\n# Process all LNK files in a directory\nLECmd.exe -d \"C:\\cases\\lnk\\recent\\\" --csv \"C:\\cases\\analysis\\\" --csvf lnk_analysis.csv\n\n# Process a single LNK file with verbose output\nLECmd.exe -f \"C:\\cases\\lnk\\recent\\document.pdf.lnk\"\n\n# Process Jump List files\nJLECmd.exe -d \"C:\\cases\\lnk\\recent\\\" --csv \"C:\\cases\\analysis\\\" --csvf jumplist_analysis.csv\n\n# Output includes:\n# - Source file path\n# - Target path (file that was accessed)\n# - Target creation, modification, access timestamps\n# - LNK creation and modification timestamps\n# - Working directory\n# - Command line arguments\n# - Volume serial number and label\n# - Drive type (Fixed, Removable, Network)\n# - Machine ID (NetBIOS name)\n# - MAC address (from tracker database)\n# - File size of target\n```\n\n### Step 3: Parse LNK Files with Python\n\n```bash\npip install LnkParse3\n\npython3 \u003C\u003C 'PYEOF'\nimport LnkParse3\nimport os, json, csv\nfrom datetime import datetime\n\nlnk_dir = '\u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F'\nresults = []\n\nfor filename in sorted(os.listdir(lnk_dir)):\n    if not filename.lower().endswith('.lnk'):\n        continue\n\n    filepath = os.path.join(lnk_dir, filename)\n    try:\n        with open(filepath, 'rb') as f:\n            lnk = LnkParse3.lnk_file(f)\n            info = lnk.get_json()\n\n            parsed = {\n                'lnk_file': filename,\n                'target_path': '',\n                'working_dir': '',\n                'arguments': '',\n                'target_created': '',\n                'target_modified': '',\n                'target_accessed': '',\n                'file_size': '',\n                'drive_type': '',\n                'volume_serial': '',\n                'volume_label': '',\n                'machine_id': '',\n                'mac_address': '',\n            }\n\n            # Extract header timestamps\n            header = info.get('header', {})\n            parsed['target_created'] = str(header.get('creation_time', ''))\n            parsed['target_modified'] = str(header.get('modified_time', ''))\n            parsed['target_accessed'] = str(header.get('accessed_time', ''))\n            parsed['file_size'] = str(header.get('file_size', ''))\n\n            # Extract link info\n            link_info = info.get('link_info', {})\n            if link_info:\n                local_path = link_info.get('local_base_path', '')\n                network_path = link_info.get('common_network_relative_link', {}).get('net_name', '')\n                parsed['target_path'] = local_path or network_path\n\n                vol_info = link_info.get('volume_id', {})\n                if vol_info:\n                    parsed['drive_type'] = str(vol_info.get('drive_type', ''))\n                    parsed['volume_serial'] = str(vol_info.get('drive_serial_number', ''))\n                    parsed['volume_label'] = str(vol_info.get('volume_label', ''))\n\n            # Extract string data\n            string_data = info.get('string_data', {})\n            parsed['working_dir'] = str(string_data.get('working_dir', ''))\n            parsed['arguments'] = str(string_data.get('command_line_arguments', ''))\n\n            # Extract tracker data (machine ID and MAC)\n            extra = info.get('extra', {})\n            tracker = extra.get('DISTRIBUTED_LINK_TRACKER_BLOCK', {})\n            if tracker:\n                parsed['machine_id'] = str(tracker.get('machine_id', ''))\n                parsed['mac_address'] = str(tracker.get('mac_address', ''))\n\n            results.append(parsed)\n\n            # Print summary\n            print(f\"\\n{filename}\")\n            print(f\"  Target: {parsed['target_path']}\")\n            print(f\"  Modified: {parsed['target_modified']}\")\n            print(f\"  Drive: {parsed['drive_type']} (Serial: {parsed['volume_serial']})\")\n            if parsed['machine_id']:\n                print(f\"  Machine: {parsed['machine_id']}\")\n\n    except Exception as e:\n        print(f\"  Error parsing {filename}: {e}\")\n\n# Write results to CSV\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flnk_analysis.csv', 'w', newline='') as f:\n    writer = csv.DictWriter(f, fieldnames=results[0].keys() if results else [])\n    writer.writeheader()\n    writer.writerows(results)\n\nprint(f\"\\n\\nTotal LNK files parsed: {len(results)}\")\nPYEOF\n```\n\n### Step 4: Analyze for Investigative Value\n\n```bash\n# Identify files accessed from removable media\npython3 \u003C\u003C 'PYEOF'\nimport csv\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flnk_analysis.csv') as f:\n    reader = csv.DictReader(f)\n\n    print(\"=== FILES ACCESSED FROM REMOVABLE MEDIA ===\\n\")\n    removable = []\n    network = []\n\n    for row in reader:\n        if 'DRIVE_REMOVABLE' in row.get('drive_type', '').upper() or \\\n           'removable' in row.get('drive_type', '').lower():\n            removable.append(row)\n            print(f\"  {row['target_modified']} | {row['target_path']} | Vol: {row['volume_serial']}\")\n\n        if 'network' in row.get('drive_type', '').lower() or \\\n           row.get('target_path', '').startswith('\\\\\\\\'):\n            network.append(row)\n\n    print(f\"\\n=== FILES ACCESSED FROM NETWORK SHARES ===\\n\")\n    for row in network:\n        print(f\"  {row['target_modified']} | {row['target_path']}\")\n\n    print(f\"\\nRemovable media files: {len(removable)}\")\n    print(f\"Network share files: {len(network)}\")\n\n    # Check for unique machines (tracker data)\n    machines = set()\n    for row in [*removable, *network]:\n        if row.get('machine_id'):\n            machines.add(row['machine_id'])\n    if machines:\n        print(f\"\\nMachine IDs found: {machines}\")\nPYEOF\n\n# Check Startup folder LNK files for persistence\necho \"=== STARTUP FOLDER SHORTCUTS (PERSISTENCE) ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_persistence.txt\nfor lnk in \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fstartup\u002F*.lnk; do\n    python3 -c \"\nimport LnkParse3\nwith open('$lnk', 'rb') as f:\n    lnk = LnkParse3.lnk_file(f)\n    info = lnk.get_json()\n    target = info.get('link_info', {}).get('local_base_path', 'Unknown')\n    args = info.get('string_data', {}).get('command_line_arguments', '')\n    print(f'  $(basename $lnk): {target} {args}')\n\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_persistence.txt 2>\u002Fdev\u002Fnull\ndone\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Shell Link (.lnk) | Windows shortcut file format containing target path, timestamps, and metadata |\n| Target timestamps | Creation, modification, and access times of the file the shortcut points to |\n| Volume serial number | Unique identifier of the drive volume where the target file resides |\n| Machine ID | NetBIOS name embedded by the Distributed Link Tracking service |\n| MAC address | Network adapter MAC from the machine that created the LNK file |\n| Jump Lists | Recent and pinned file lists per application (contain embedded LNK data) |\n| Automatic Destinations | System-managed Jump List entries for recently opened files |\n| Custom Destinations | User-pinned Jump List items that persist until manually removed |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| LECmd | Eric Zimmerman command-line LNK file parser with CSV\u002FJSON output |\n| JLECmd | Eric Zimmerman Jump List parser |\n| LnkParse3 | Python library for programmatic LNK file analysis |\n| lnk_parser | Alternative Python LNK parsing tool |\n| Autopsy | Forensic platform with LNK file analysis module |\n| KAPE | Automated LNK and Jump List artifact collection |\n| Plaso | Timeline tool with LNK file parser for super-timeline creation |\n| LNK Explorer | GUI tool for interactive LNK file examination |\n\n## Common Scenarios\n\n**Scenario 1: Data Exfiltration via USB Drive**\nAnalyze Recent folder LNK files for targets on removable drives, correlate volume serial numbers with USBSTOR registry entries, build a list of files accessed from USB devices, establish which documents were opened from the removable drive, correlate with file copy timestamps.\n\n**Scenario 2: Malware Persistence via Startup Shortcuts**\nExamine Startup folder LNK files for malicious targets, check target path and arguments for encoded commands or suspicious executables, verify target file exists and examine it, correlate creation timestamp with initial compromise time.\n\n**Scenario 3: Network Share Access Investigation**\nFilter LNK files with network paths (UNC targets), identify which network shares were accessed and when, correlate machine IDs with known corporate systems, check if sensitive file servers were accessed outside of normal duties, build access timeline for compliance investigation.\n\n**Scenario 4: Document Access Timeline for Legal Proceedings**\nExtract all Recent folder LNK files, build chronological list of documents accessed by the user, identify specific files relevant to the case, present target timestamps showing when files were opened, correlate with email and communication timelines.\n\n## Output Format\n\n```\nLNK File Analysis Summary:\n  User Profile: suspect_user\n  Total LNK Files: 234 (Recent: 198, Desktop: 23, Startup: 5, Other: 8)\n\n  File Access Statistics:\n    Local drive (C:):    156 files\n    Removable media:     23 files (3 unique volume serials)\n    Network shares:      15 files (\\\\server01, \\\\fileserver)\n    Other drives:        4 files\n\n  Machine IDs Found: DESKTOP-ABC123, LAPTOP-XYZ789\n  MAC Addresses: AA:BB:CC:DD:EE:FF, 11:22:33:44:55:66\n\n  Removable Media Access:\n    Volume Serial 1234-ABCD:\n      2024-01-15 14:32 - E:\\Confidential\\financial_report.xlsx\n      2024-01-15 14:45 - E:\\Confidential\\customer_database.csv\n      2024-01-15 15:00 - E:\\Projects\\source_code.zip\n\n  Startup Persistence:\n    updater.lnk -> C:\\ProgramData\\svc\\updater.exe (SUSPICIOUS)\n    OneDrive.lnk -> C:\\Users\\...\\OneDrive.exe (Legitimate)\n\n  Timeline: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flnk_analysis.csv\n```\n","# Analyzing Windows LNK Files for Artifacts\n\n## When to Use\n- When reconstructing user file access history from Windows shortcut files\n- For tracking accessed files, network shares, and removable media\n- During investigations to prove a user opened specific documents\n- When correlating file access with other timeline artifacts\n- For identifying accessed paths on remote systems or USB devices\n\n## Prerequisites\n- Access to LNK files from forensic image (Recent, Desktop, Quick Launch)\n- LECmd (Eric Zimmerman), python-lnk, or LnkParser for analysis\n- Understanding of LNK file structure (Shell Link Binary format)\n- Knowledge of LNK file locations on Windows systems\n- Forensic workstation with analysis tools installed\n\n## Workflow\n\n### Step 1: Collect LNK Files from Forensic Image\n\n```bash\n# Mount forensic image\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Flnk\u002F{recent,desktop,startup,custom}\n\n# Copy Recent items LNK files (primary source)\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FRecent\u002F*.lnk \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F 2>\u002Fdev\u002Fnull\n\n# Copy automatic destinations (Jump Lists)\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FRecent\u002FAutomaticDestinations\u002F*.automaticDestinations-ms \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F 2>\u002Fdev\u002Fnull\n\n# Copy custom destinations (pinned Jump List items)\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FRecent\u002FCustomDestinations\u002F*.customDestinations-ms \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fcustom\u002F 2>\u002Fdev\u002Fnull\n\n# Copy Desktop shortcuts\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FDesktop\u002F*.lnk \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fdesktop\u002F 2>\u002Fdev\u002Fnull\n\n# Copy Startup folder shortcuts (persistence)\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FStart\\ Menu\u002FPrograms\u002FStartup\u002F*.lnk \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fstartup\u002F 2>\u002Fdev\u002Fnull\ncp \"\u002Fmnt\u002Fevidence\u002FProgramData\u002FMicrosoft\u002FWindows\u002FStart Menu\u002FPrograms\u002FStartup\"\u002F*.lnk \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fstartup\u002F 2>\u002Fdev\u002Fnull\n\n# Find all LNK files on the system\nfind \u002Fmnt\u002Fevidence\u002F -name \"*.lnk\" -type f 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fall_lnk_locations.txt\n\n# Count and hash\nls \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F | wc -l\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F*.lnk > \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Flnk_hashes.txt 2>\u002Fdev\u002Fnull\n```\n\n### Step 2: Parse LNK Files with LECmd\n\n```bash\n# Using Eric Zimmerman's LECmd (Windows or via Mono)\n# Process all LNK files in a directory\nLECmd.exe -d \"C:\\cases\\lnk\\recent\\\" --csv \"C:\\cases\\analysis\\\" --csvf lnk_analysis.csv\n\n# Process a single LNK file with verbose output\nLECmd.exe -f \"C:\\cases\\lnk\\recent\\document.pdf.lnk\"\n\n# Process Jump List files\nJLECmd.exe -d \"C:\\cases\\lnk\\recent\\\" --csv \"C:\\cases\\analysis\\\" --csvf jumplist_analysis.csv\n\n# Output includes:\n# - Source file path\n# - Target path (file that was accessed)\n# - Target creation, modification, access timestamps\n# - LNK creation and modification timestamps\n# - Working directory\n# - Command line arguments\n# - Volume serial number and label\n# - Drive type (Fixed, Removable, Network)\n# - Machine ID (NetBIOS name)\n# - MAC address (from tracker database)\n# - File size of target\n```\n\n### Step 3: Parse LNK Files with Python\n\n```bash\npip install LnkParse3\n\npython3 \u003C\u003C 'PYEOF'\nimport LnkParse3\nimport os, json, csv\nfrom datetime import datetime\n\nlnk_dir = '\u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F'\nresults = []\n\nfor filename in sorted(os.listdir(lnk_dir)):\n    if not filename.lower().endswith('.lnk'):\n        continue\n\n    filepath = os.path.join(lnk_dir, filename)\n    try:\n        with open(filepath, 'rb') as f:\n            lnk = LnkParse3.lnk_file(f)\n            info = lnk.get_json()\n\n            parsed = {\n                'lnk_file': filename,\n                'target_path': '',\n                'working_dir': '',\n                'arguments': '',\n                'target_created': '',\n                'target_modified': '',\n                'target_accessed': '',\n                'file_size': '',\n                'drive_type': '',\n                'volume_serial': '',\n                'volume_label': '',\n                'machine_id': '',\n                'mac_address': '',\n            }\n\n            # Extract header timestamps\n            header = info.get('header', {})\n            parsed['target_created'] = str(header.get('creation_time', ''))\n            parsed['target_modified'] = str(header.get('modified_time', ''))\n            parsed['target_accessed'] = str(header.get('accessed_time', ''))\n            parsed['file_size'] = str(header.get('file_size', ''))\n\n            # Extract link info\n            link_info = info.get('link_info', {})\n            if link_info:\n                local_path = link_info.get('local_base_path', '')\n                network_path = link_info.get('common_network_relative_link', {}).get('net_name', '')\n                parsed['target_path'] = local_path or network_path\n\n                vol_info = link_info.get('volume_id', {})\n                if vol_info:\n                    parsed['drive_type'] = str(vol_info.get('drive_type', ''))\n                    parsed['volume_serial'] = str(vol_info.get('drive_serial_number', ''))\n                    parsed['volume_label'] = str(vol_info.get('volume_label', ''))\n\n            # Extract string data\n            string_data = info.get('string_data', {})\n            parsed['working_dir'] = str(string_data.get('working_dir', ''))\n            parsed['arguments'] = str(string_data.get('command_line_arguments', ''))\n\n            # Extract tracker data (machine ID and MAC)\n            extra = info.get('extra', {})\n            tracker = extra.get('DISTRIBUTED_LINK_TRACKER_BLOCK', {})\n            if tracker:\n                parsed['machine_id'] = str(tracker.get('machine_id', ''))\n                parsed['mac_address'] = str(tracker.get('mac_address', ''))\n\n            results.append(parsed)\n\n            # Print summary\n            print(f\"\\n{filename}\")\n            print(f\"  Target: {parsed['target_path']}\")\n            print(f\"  Modified: {parsed['target_modified']}\")\n            print(f\"  Drive: {parsed['drive_type']} (Serial: {parsed['volume_serial']})\")\n            if parsed['machine_id']:\n                print(f\"  Machine: {parsed['machine_id']}\")\n\n    except Exception as e:\n        print(f\"  Error parsing {filename}: {e}\")\n\n# Write results to CSV\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flnk_analysis.csv', 'w', newline='') as f:\n    writer = csv.DictWriter(f, fieldnames=results[0].keys() if results else [])\n    writer.writeheader()\n    writer.writerows(results)\n\nprint(f\"\\n\\nTotal LNK files parsed: {len(results)}\")\nPYEOF\n```\n\n### Step 4: Analyze for Investigative Value\n\n```bash\n# Identify files accessed from removable media\npython3 \u003C\u003C 'PYEOF'\nimport csv\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flnk_analysis.csv') as f:\n    reader = csv.DictReader(f)\n\n    print(\"=== FILES ACCESSED FROM REMOVABLE MEDIA ===\\n\")\n    removable = []\n    network = []\n\n    for row in reader:\n        if 'DRIVE_REMOVABLE' in row.get('drive_type', '').upper() or \\\n           'removable' in row.get('drive_type', '').lower():\n            removable.append(row)\n            print(f\"  {row['target_modified']} | {row['target_path']} | Vol: {row['volume_serial']}\")\n\n        if 'network' in row.get('drive_type', '').lower() or \\\n           row.get('target_path', '').startswith('\\\\\\\\'):\n            network.append(row)\n\n    print(f\"\\n=== FILES ACCESSED FROM NETWORK SHARES ===\\n\")\n    for row in network:\n        print(f\"  {row['target_modified']} | {row['target_path']}\")\n\n    print(f\"\\nRemovable media files: {len(removable)}\")\n    print(f\"Network share files: {len(network)}\")\n\n    # Check for unique machines (tracker data)\n    machines = set()\n    for row in [*removable, *network]:\n        if row.get('machine_id'):\n            machines.add(row['machine_id'])\n    if machines:\n        print(f\"\\nMachine IDs found: {machines}\")\nPYEOF\n\n# Check Startup folder LNK files for persistence\necho \"=== STARTUP FOLDER SHORTCUTS (PERSISTENCE) ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_persistence.txt\nfor lnk in \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fstartup\u002F*.lnk; do\n    python3 -c \"\nimport LnkParse3\nwith open('$lnk', 'rb') as f:\n    lnk = LnkParse3.lnk_file(f)\n    info = lnk.get_json()\n    target = info.get('link_info', {}).get('local_base_path', 'Unknown')\n    args = info.get('string_data', {}).get('command_line_arguments', '')\n    print(f'  $(basename $lnk): {target} {args}')\n\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_persistence.txt 2>\u002Fdev\u002Fnull\ndone\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Shell Link (.lnk) | Windows shortcut file format containing target path, timestamps, and metadata |\n| Target timestamps | Creation, modification, and access times of the file the shortcut points to |\n| Volume serial number | Unique identifier of the drive volume where the target file resides |\n| Machine ID | NetBIOS name embedded by the Distributed Link Tracking service |\n| MAC address | Network adapter MAC from the machine that created the LNK file |\n| Jump Lists | Recent and pinned file lists per application (contain embedded LNK data) |\n| Automatic Destinations | System-managed Jump List entries for recently opened files |\n| Custom Destinations | User-pinned Jump List items that persist until manually removed |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| LECmd | Eric Zimmerman command-line LNK file parser with CSV\u002FJSON output |\n| JLECmd | Eric Zimmerman Jump List parser |\n| LnkParse3 | Python library for programmatic LNK file analysis |\n| lnk_parser | Alternative Python LNK parsing tool |\n| Autopsy | Forensic platform with LNK file analysis module |\n| KAPE | Automated LNK and Jump List artifact collection |\n| Plaso | Timeline tool with LNK file parser for super-timeline creation |\n| LNK Explorer | GUI tool for interactive LNK file examination |\n\n## Common Scenarios\n\n**Scenario 1: Data Exfiltration via USB Drive**\nAnalyze Recent folder LNK files for targets on removable drives, correlate volume serial numbers with USBSTOR registry entries, build a list of files accessed from USB devices, establish which documents were opened from the removable drive, correlate with file copy timestamps.\n\n**Scenario 2: Malware Persistence via Startup Shortcuts**\nExamine Startup folder LNK files for malicious targets, check target path and arguments for encoded commands or suspicious executables, verify target file exists and examine it, correlate creation timestamp with initial compromise time.\n\n**Scenario 3: Network Share Access Investigation**\nFilter LNK files with network paths (UNC targets), identify which network shares were accessed and when, correlate machine IDs with known corporate systems, check if sensitive file servers were accessed outside of normal duties, build access timeline for compliance investigation.\n\n**Scenario 4: Document Access Timeline for Legal Proceedings**\nExtract all Recent folder LNK files, build chronological list of documents accessed by the user, identify specific files relevant to the case, present target timestamps showing when files were opened, correlate with email and communication timelines.\n\n## Output Format\n\n```\nLNK File Analysis Summary:\n  User Profile: suspect_user\n  Total LNK Files: 234 (Recent: 198, Desktop: 23, Startup: 5, Other: 8)\n\n  File Access Statistics:\n    Local drive (C:):    156 files\n    Removable media:     23 files (3 unique volume serials)\n    Network shares:      15 files (\\\\server01, \\\\fileserver)\n    Other drives:        4 files\n\n  Machine IDs Found: DESKTOP-ABC123, LAPTOP-XYZ789\n  MAC Addresses: AA:BB:CC:DD:EE:FF, 11:22:33:44:55:66\n\n  Removable Media Access:\n    Volume Serial 1234-ABCD:\n      2024-01-15 14:32 - E:\\Confidential\\financial_report.xlsx\n      2024-01-15 14:45 - E:\\Confidential\\customer_database.csv\n      2024-01-15 15:00 - E:\\Projects\\source_code.zip\n\n  Startup Persistence:\n    updater.lnk -> C:\\ProgramData\\svc\\updater.exe (SUSPICIOUS)\n    OneDrive.lnk -> C:\\Users\\...\\OneDrive.exe (Legitimate)\n\n  Timeline: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flnk_analysis.csv\n```\n",{"name":5,"tags":49,"author":51,"domain":30,"license":15,"version":52,"nist_csf":53,"subdomain":58,"description":7,"mitre_attack":59},[43,42,41,39,50,40],"timeline-reconstruction","mahipal","1.0",[54,55,56,57],"RS.AN-01","RS.AN-03","DE.AE-02","RS.MA-01","digital-forensics",[38,60,61,62,63],"T1204.002","T1005","T1025","T1074.001","main","7925716f065257435fdb12e97f7e52842147d5ad",".claude\u002Fskills\u002Fanalyzing-windows-lnk-files-for-artifacts","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude","https:\u002F\u002Fclaude.com\u002Fclaude-code","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho","Software · Applied AI · Quantitative Modeling · Building with Claude.","2026-06-10 12:24:46",{"source":8,"skillName":5,"commands":73,"prompt":83,"zipAvailable":84},[74,77,80],{"tool":75,"command":76},"npx","npx skills add henriquescastilho\u002Fmy-claude --skill analyzing-windows-lnk-files-for-artifacts",{"tool":78,"command":79},"bunx","bunx skills add henriquescastilho\u002Fmy-claude --skill analyzing-windows-lnk-files-for-artifacts",{"tool":81,"command":82},"pnpm","pnpm dlx skills add henriquescastilho\u002Fmy-claude --skill analyzing-windows-lnk-files-for-artifacts","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-windows-lnk-files-for-artifacts\u002FSKILL.md",true,[86,92,97,101,107],{"path":87,"resourceType":88,"resourceTypeDesc":89,"sizeBytes":90,"sourceHtmlUrl":91},"assets\u002Fcover.png","ASSET","资产文件",1208262,"https:\u002F\u002Fgithub.com\u002Faqm857886159\u002FNomi\u002Fblob\u002Fmain\u002Fskills\u002Feffect-camera-08\u002Fassets\u002Fcover.png",{"path":93,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":95,"sourceHtmlUrl":96},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-windows-lnk-files-for-artifacts\u002FLICENSE",{"path":98,"resourceType":93,"resourceTypeDesc":94,"sizeBytes":99,"sourceHtmlUrl":100},"LICENSE.txt",1067,"https:\u002F\u002Fgithub.com\u002Faqm857886159\u002FNomi\u002Fblob\u002Fmain\u002Fskills\u002Feffect-camera-08\u002FLICENSE.txt",{"path":102,"resourceType":103,"resourceTypeDesc":104,"sizeBytes":105,"sourceHtmlUrl":106},"references\u002Fapi-reference.md","REFERENCE","参考文档",2301,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-windows-lnk-files-for-artifacts\u002Freferences\u002Fapi-reference.md",{"path":108,"resourceType":109,"resourceTypeDesc":110,"sizeBytes":111,"sourceHtmlUrl":112},"scripts\u002Fagent.py","SCRIPT","脚本",6645,"https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fanalyzing-windows-lnk-files-for-artifacts\u002Fscripts\u002Fagent.py",[114,154,163,172,194,219],{"skillNo":115,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":118,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":135,"publishedAt":44},"01M6F0B6XPQ65AX2X0DWK8KT3E","markitdown","Convert files and office documents to Markdown. Supports PDF, DOCX, PPTX, XLSX, images (with OCR), audio (with transcription), HTML, CSV, JSON, XML, ZIP, YouTube URLs, EPubs and more.","MIT","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[121,124,127,130],{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000002","文档处理",{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000003","演示文稿",{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000004","电子表格",{"categoryNo":131,"categoryName":132,"taxonomyType":133,"taxonomyTypeDesc":134},"01JBSEEDCAT000000000000034","行政与办公人员","PROFESSION","适用职业",[116,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,28,152,153],"docx","PDF","pptx","xlsx","documents","csv","ocr","Audio","Bash","markdown","convert","read","write","edit","html","images","youtube","with",{"skillNo":155,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":118,"licenseFileUrl":6,"sourceHtmlUrl":156,"categories":157,"keywords":162,"publishedAt":44},"01M6F06SBHR9F0SDWE282Y8075","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002Fscientific_writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[158,159,160,161],{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":131,"categoryName":132,"taxonomyType":133,"taxonomyTypeDesc":134},[116,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,28,152,153],{"skillNo":164,"name":116,"nameZh":6,"description":117,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":118,"licenseFileUrl":6,"sourceHtmlUrl":165,"categories":166,"keywords":171,"publishedAt":44},"01M6F02D4R14EJAPBWVDF9J9VQ","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-writer\u002F.claude\u002Fskills\u002Fmarkitdown\u002FSKILL.md",[167,168,169,170],{"categoryNo":122,"categoryName":123,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":125,"categoryName":126,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":128,"categoryName":129,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":131,"categoryName":132,"taxonomyType":133,"taxonomyTypeDesc":134},[116,136,137,138,139,140,141,142,143,144,145,146,147,148,149,150,151,28,152,153],{"skillNo":173,"name":174,"nameZh":6,"description":175,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":118,"licenseFileUrl":6,"sourceHtmlUrl":176,"categories":177,"keywords":178,"publishedAt":44},"01M6F000KS6YB4MKS774G4R8ND","zarr-python","Chunked N-D arrays for cloud storage. Compressed arrays, parallel I\u002FO, S3\u002FGCS integration, NumPy\u002FDask\u002FXarray compatible, for large-scale scientific computing pipelines.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fzarr-python\u002FSKILL.md",[],[179,180,181,182,183,184,185,186,187,188,189,190,191,192,193],"python","zarr python","storage","integration","s3","gcs","cloud","dask","parallel","pipelines","arrays","numpy","scientific computing","scale","scientific",{"skillNo":195,"name":196,"nameZh":6,"description":197,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":118,"licenseFileUrl":6,"sourceHtmlUrl":198,"categories":199,"keywords":201,"publishedAt":44},"01M6EZZJWFXM1GR78KTW6J0DN8","what-if-oracle","Run structured What-If scenario analysis with multi-branch possibility exploration. Use this skill when the user asks speculative questions like \"what if...\", \"what would happen if...\", \"what are the possibilities\", \"explore scenarios\", \"scenario analysis\", \"possibility space\", \"what could go wrong\", \"best case \u002F worst case\", \"risk analysis\", \"contingency planning\", \"strategic options\", or any question about uncertain futures. Also trigger when the user faces a fork-in-the-road decision, wants to stress-test an idea, or needs to think through consequences before committing.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fwhat-if-oracle\u002FSKILL.md",[200],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[202,203,204,205,206,207,36,208,209,210,211,147,148,212,213,214,215,216,217,218],"oracle","what if oracle","go","run","ux","futures","explore","decision","branch","question","idea","exploration","options","stress-test","strategies","scenario","stress",{"skillNo":220,"name":221,"nameZh":6,"description":222,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":118,"licenseFileUrl":6,"sourceHtmlUrl":223,"categories":224,"keywords":235,"publishedAt":44},"01M6EZZCXAEB49RXGQCJX5E8GB","venue-templates","Access comprehensive LaTeX templates, formatting requirements, and submission guidelines for major scientific publication venues (Nature, Science, PLOS, IEEE, ACM), academic conferences (NeurIPS, ICML, CVPR, CHI), research posters, and grant proposals (NSF, NIH, DOE, DARPA). This skill should be used when preparing manuscripts for journal submission, conference papers, research posters, or grant proposals and need venue-specific formatting requirements and templates.","https:\u002F\u002Fgithub.com\u002Fhenriquescastilho\u002Fmy-claude\u002Fblob\u002Fmain\u002F.codex\u002Fvendor_imports\u002Fclaude\u002Fmarketplaces\u002Fclaude-scientific-skills\u002Fscientific-skills\u002Fvenue-templates\u002FSKILL.md",[225,228,231,232],{"categoryNo":226,"categoryName":227,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":229,"categoryName":230,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":233,"categoryName":234,"taxonomyType":133,"taxonomyTypeDesc":134},"01JBSEEDCAT000000000000036","内容创作者",[236,237,238,239,240,241,242,243,144,244,147,148,149,245,246,247,248,249,193,250],"templates","venue templates","research","guidelines","NeurIPS","ICML","LaTeX","science","access","proposals","Academic","requirements","formatting","journal","chi"]