[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M78GSDFADMCVHW3882ZRQ7VT":3,"skill-same:01M78GSDFADMCVHW3882ZRQ7VT":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":36,"commitSha":37,"skillDirectory":38,"forksCount":39,"repositoryHtmlUrl":40,"repositoryHomepageUrl":6,"ownerHtmlUrl":41,"ownerBlogUrl":42,"ownerDescription":43,"updatedAt":44,"install":45,"resources":58},"01M78GSDFADMCVHW3882ZRQ7VT","analyzing-windows-lnk-files-for-artifacts",null,"Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.","jukeyman\u002Fjukeyman-skills","jukeyman","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F142960420?v=4","01M78FR4Y3DHMMCBCC0GXXNB3F","RICK JEFFERSON","01M78FR4Z8RVQRAD31Y5J7V6EB",1,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-windows-lnk-files-for-artifacts\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-windows-lnk-files-for-artifacts\u002FSKILL.md",[],[],"2026-11-15 14:19:17",false,"---\nname: analyzing-windows-lnk-files-for-artifacts\ndescription: Parse Windows LNK shortcut files to extract target paths, timestamps, volume information, and machine identifiers for forensic timeline reconstruction.\ndomain: cybersecurity\nsubdomain: digital-forensics\ntags: [forensics, lnk-files, windows-artifacts, shortcut-analysis, timeline-reconstruction, evidence-collection]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n\n# Analyzing Windows LNK Files for Artifacts\n\n## When to Use\n- When reconstructing user file access history from Windows shortcut files\n- For tracking accessed files, network shares, and removable media\n- During investigations to prove a user opened specific documents\n- When correlating file access with other timeline artifacts\n- For identifying accessed paths on remote systems or USB devices\n\n## Prerequisites\n- Access to LNK files from forensic image (Recent, Desktop, Quick Launch)\n- LECmd (Eric Zimmerman), python-lnk, or LnkParser for analysis\n- Understanding of LNK file structure (Shell Link Binary format)\n- Knowledge of LNK file locations on Windows systems\n- Forensic workstation with analysis tools installed\n\n## Workflow\n\n### Step 1: Collect LNK Files from Forensic Image\n\n```bash\n# Mount forensic image\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Flnk\u002F{recent,desktop,startup,custom}\n\n# Copy Recent items LNK files (primary source)\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FRecent\u002F*.lnk \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F 2>\u002Fdev\u002Fnull\n\n# Copy automatic destinations (Jump Lists)\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FRecent\u002FAutomaticDestinations\u002F*.automaticDestinations-ms \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F 2>\u002Fdev\u002Fnull\n\n# Copy custom destinations (pinned Jump List items)\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FRecent\u002FCustomDestinations\u002F*.customDestinations-ms \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fcustom\u002F 2>\u002Fdev\u002Fnull\n\n# Copy Desktop shortcuts\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FDesktop\u002F*.lnk \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fdesktop\u002F 2>\u002Fdev\u002Fnull\n\n# Copy Startup folder shortcuts (persistence)\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FStart\\ Menu\u002FPrograms\u002FStartup\u002F*.lnk \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fstartup\u002F 2>\u002Fdev\u002Fnull\ncp \"\u002Fmnt\u002Fevidence\u002FProgramData\u002FMicrosoft\u002FWindows\u002FStart Menu\u002FPrograms\u002FStartup\"\u002F*.lnk \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fstartup\u002F 2>\u002Fdev\u002Fnull\n\n# Find all LNK files on the system\nfind \u002Fmnt\u002Fevidence\u002F -name \"*.lnk\" -type f 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fall_lnk_locations.txt\n\n# Count and hash\nls \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F | wc -l\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F*.lnk > \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Flnk_hashes.txt 2>\u002Fdev\u002Fnull\n```\n\n### Step 2: Parse LNK Files with LECmd\n\n```bash\n# Using Eric Zimmerman's LECmd (Windows or via Mono)\n# Process all LNK files in a directory\nLECmd.exe -d \"C:\\cases\\lnk\\recent\\\" --csv \"C:\\cases\\analysis\\\" --csvf lnk_analysis.csv\n\n# Process a single LNK file with verbose output\nLECmd.exe -f \"C:\\cases\\lnk\\recent\\document.pdf.lnk\"\n\n# Process Jump List files\nJLECmd.exe -d \"C:\\cases\\lnk\\recent\\\" --csv \"C:\\cases\\analysis\\\" --csvf jumplist_analysis.csv\n\n# Output includes:\n# - Source file path\n# - Target path (file that was accessed)\n# - Target creation, modification, access timestamps\n# - LNK creation and modification timestamps\n# - Working directory\n# - Command line arguments\n# - Volume serial number and label\n# - Drive type (Fixed, Removable, Network)\n# - Machine ID (NetBIOS name)\n# - MAC address (from tracker database)\n# - File size of target\n```\n\n### Step 3: Parse LNK Files with Python\n\n```bash\npip install LnkParse3\n\npython3 \u003C\u003C 'PYEOF'\nimport LnkParse3\nimport os, json, csv\nfrom datetime import datetime\n\nlnk_dir = '\u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F'\nresults = []\n\nfor filename in sorted(os.listdir(lnk_dir)):\n    if not filename.lower().endswith('.lnk'):\n        continue\n\n    filepath = os.path.join(lnk_dir, filename)\n    try:\n        with open(filepath, 'rb') as f:\n            lnk = LnkParse3.lnk_file(f)\n            info = lnk.get_json()\n\n            parsed = {\n                'lnk_file': filename,\n                'target_path': '',\n                'working_dir': '',\n                'arguments': '',\n                'target_created': '',\n                'target_modified': '',\n                'target_accessed': '',\n                'file_size': '',\n                'drive_type': '',\n                'volume_serial': '',\n                'volume_label': '',\n                'machine_id': '',\n                'mac_address': '',\n            }\n\n            # Extract header timestamps\n            header = info.get('header', {})\n            parsed['target_created'] = str(header.get('creation_time', ''))\n            parsed['target_modified'] = str(header.get('modified_time', ''))\n            parsed['target_accessed'] = str(header.get('accessed_time', ''))\n            parsed['file_size'] = str(header.get('file_size', ''))\n\n            # Extract link info\n            link_info = info.get('link_info', {})\n            if link_info:\n                local_path = link_info.get('local_base_path', '')\n                network_path = link_info.get('common_network_relative_link', {}).get('net_name', '')\n                parsed['target_path'] = local_path or network_path\n\n                vol_info = link_info.get('volume_id', {})\n                if vol_info:\n                    parsed['drive_type'] = str(vol_info.get('drive_type', ''))\n                    parsed['volume_serial'] = str(vol_info.get('drive_serial_number', ''))\n                    parsed['volume_label'] = str(vol_info.get('volume_label', ''))\n\n            # Extract string data\n            string_data = info.get('string_data', {})\n            parsed['working_dir'] = str(string_data.get('working_dir', ''))\n            parsed['arguments'] = str(string_data.get('command_line_arguments', ''))\n\n            # Extract tracker data (machine ID and MAC)\n            extra = info.get('extra', {})\n            tracker = extra.get('DISTRIBUTED_LINK_TRACKER_BLOCK', {})\n            if tracker:\n                parsed['machine_id'] = str(tracker.get('machine_id', ''))\n                parsed['mac_address'] = str(tracker.get('mac_address', ''))\n\n            results.append(parsed)\n\n            # Print summary\n            print(f\"\\n{filename}\")\n            print(f\"  Target: {parsed['target_path']}\")\n            print(f\"  Modified: {parsed['target_modified']}\")\n            print(f\"  Drive: {parsed['drive_type']} (Serial: {parsed['volume_serial']})\")\n            if parsed['machine_id']:\n                print(f\"  Machine: {parsed['machine_id']}\")\n\n    except Exception as e:\n        print(f\"  Error parsing {filename}: {e}\")\n\n# Write results to CSV\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flnk_analysis.csv', 'w', newline='') as f:\n    writer = csv.DictWriter(f, fieldnames=results[0].keys() if results else [])\n    writer.writeheader()\n    writer.writerows(results)\n\nprint(f\"\\n\\nTotal LNK files parsed: {len(results)}\")\nPYEOF\n```\n\n### Step 4: Analyze for Investigative Value\n\n```bash\n# Identify files accessed from removable media\npython3 \u003C\u003C 'PYEOF'\nimport csv\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flnk_analysis.csv') as f:\n    reader = csv.DictReader(f)\n\n    print(\"=== FILES ACCESSED FROM REMOVABLE MEDIA ===\\n\")\n    removable = []\n    network = []\n\n    for row in reader:\n        if 'DRIVE_REMOVABLE' in row.get('drive_type', '').upper() or \\\n           'removable' in row.get('drive_type', '').lower():\n            removable.append(row)\n            print(f\"  {row['target_modified']} | {row['target_path']} | Vol: {row['volume_serial']}\")\n\n        if 'network' in row.get('drive_type', '').lower() or \\\n           row.get('target_path', '').startswith('\\\\\\\\'):\n            network.append(row)\n\n    print(f\"\\n=== FILES ACCESSED FROM NETWORK SHARES ===\\n\")\n    for row in network:\n        print(f\"  {row['target_modified']} | {row['target_path']}\")\n\n    print(f\"\\nRemovable media files: {len(removable)}\")\n    print(f\"Network share files: {len(network)}\")\n\n    # Check for unique machines (tracker data)\n    machines = set()\n    for row in [*removable, *network]:\n        if row.get('machine_id'):\n            machines.add(row['machine_id'])\n    if machines:\n        print(f\"\\nMachine IDs found: {machines}\")\nPYEOF\n\n# Check Startup folder LNK files for persistence\necho \"=== STARTUP FOLDER SHORTCUTS (PERSISTENCE) ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_persistence.txt\nfor lnk in \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fstartup\u002F*.lnk; do\n    python3 -c \"\nimport LnkParse3\nwith open('$lnk', 'rb') as f:\n    lnk = LnkParse3.lnk_file(f)\n    info = lnk.get_json()\n    target = info.get('link_info', {}).get('local_base_path', 'Unknown')\n    args = info.get('string_data', {}).get('command_line_arguments', '')\n    print(f'  $(basename $lnk): {target} {args}')\n\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_persistence.txt 2>\u002Fdev\u002Fnull\ndone\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Shell Link (.lnk) | Windows shortcut file format containing target path, timestamps, and metadata |\n| Target timestamps | Creation, modification, and access times of the file the shortcut points to |\n| Volume serial number | Unique identifier of the drive volume where the target file resides |\n| Machine ID | NetBIOS name embedded by the Distributed Link Tracking service |\n| MAC address | Network adapter MAC from the machine that created the LNK file |\n| Jump Lists | Recent and pinned file lists per application (contain embedded LNK data) |\n| Automatic Destinations | System-managed Jump List entries for recently opened files |\n| Custom Destinations | User-pinned Jump List items that persist until manually removed |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| LECmd | Eric Zimmerman command-line LNK file parser with CSV\u002FJSON output |\n| JLECmd | Eric Zimmerman Jump List parser |\n| LnkParse3 | Python library for programmatic LNK file analysis |\n| lnk_parser | Alternative Python LNK parsing tool |\n| Autopsy | Forensic platform with LNK file analysis module |\n| KAPE | Automated LNK and Jump List artifact collection |\n| Plaso | Timeline tool with LNK file parser for super-timeline creation |\n| LNK Explorer | GUI tool for interactive LNK file examination |\n\n## Common Scenarios\n\n**Scenario 1: Data Exfiltration via USB Drive**\nAnalyze Recent folder LNK files for targets on removable drives, correlate volume serial numbers with USBSTOR registry entries, build a list of files accessed from USB devices, establish which documents were opened from the removable drive, correlate with file copy timestamps.\n\n**Scenario 2: Malware Persistence via Startup Shortcuts**\nExamine Startup folder LNK files for malicious targets, check target path and arguments for encoded commands or suspicious executables, verify target file exists and examine it, correlate creation timestamp with initial compromise time.\n\n**Scenario 3: Network Share Access Investigation**\nFilter LNK files with network paths (UNC targets), identify which network shares were accessed and when, correlate machine IDs with known corporate systems, check if sensitive file servers were accessed outside of normal duties, build access timeline for compliance investigation.\n\n**Scenario 4: Document Access Timeline for Legal Proceedings**\nExtract all Recent folder LNK files, build chronological list of documents accessed by the user, identify specific files relevant to the case, present target timestamps showing when files were opened, correlate with email and communication timelines.\n\n## Output Format\n\n```\nLNK File Analysis Summary:\n  User Profile: suspect_user\n  Total LNK Files: 234 (Recent: 198, Desktop: 23, Startup: 5, Other: 8)\n\n  File Access Statistics:\n    Local drive (C:):    156 files\n    Removable media:     23 files (3 unique volume serials)\n    Network shares:      15 files (\\\\server01, \\\\fileserver)\n    Other drives:        4 files\n\n  Machine IDs Found: DESKTOP-ABC123, LAPTOP-XYZ789\n  MAC Addresses: AA:BB:CC:DD:EE:FF, 11:22:33:44:55:66\n\n  Removable Media Access:\n    Volume Serial 1234-ABCD:\n      2024-01-15 14:32 - E:\\Confidential\\financial_report.xlsx\n      2024-01-15 14:45 - E:\\Confidential\\customer_database.csv\n      2024-01-15 15:00 - E:\\Projects\\source_code.zip\n\n  Startup Persistence:\n    updater.lnk -> C:\\ProgramData\\svc\\updater.exe (SUSPICIOUS)\n    OneDrive.lnk -> C:\\Users\\...\\OneDrive.exe (Legitimate)\n\n  Timeline: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flnk_analysis.csv\n```\n","# Analyzing Windows LNK Files for Artifacts\n\n## When to Use\n- When reconstructing user file access history from Windows shortcut files\n- For tracking accessed files, network shares, and removable media\n- During investigations to prove a user opened specific documents\n- When correlating file access with other timeline artifacts\n- For identifying accessed paths on remote systems or USB devices\n\n## Prerequisites\n- Access to LNK files from forensic image (Recent, Desktop, Quick Launch)\n- LECmd (Eric Zimmerman), python-lnk, or LnkParser for analysis\n- Understanding of LNK file structure (Shell Link Binary format)\n- Knowledge of LNK file locations on Windows systems\n- Forensic workstation with analysis tools installed\n\n## Workflow\n\n### Step 1: Collect LNK Files from Forensic Image\n\n```bash\n# Mount forensic image\nmount -o ro,loop,offset=$((2048*512)) \u002Fcases\u002Fcase-2024-001\u002Fimages\u002Fevidence.dd \u002Fmnt\u002Fevidence\n\nmkdir -p \u002Fcases\u002Fcase-2024-001\u002Flnk\u002F{recent,desktop,startup,custom}\n\n# Copy Recent items LNK files (primary source)\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FRecent\u002F*.lnk \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F 2>\u002Fdev\u002Fnull\n\n# Copy automatic destinations (Jump Lists)\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FRecent\u002FAutomaticDestinations\u002F*.automaticDestinations-ms \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F 2>\u002Fdev\u002Fnull\n\n# Copy custom destinations (pinned Jump List items)\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FRecent\u002FCustomDestinations\u002F*.customDestinations-ms \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fcustom\u002F 2>\u002Fdev\u002Fnull\n\n# Copy Desktop shortcuts\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FDesktop\u002F*.lnk \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fdesktop\u002F 2>\u002Fdev\u002Fnull\n\n# Copy Startup folder shortcuts (persistence)\ncp \u002Fmnt\u002Fevidence\u002FUsers\u002F*\u002FAppData\u002FRoaming\u002FMicrosoft\u002FWindows\u002FStart\\ Menu\u002FPrograms\u002FStartup\u002F*.lnk \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fstartup\u002F 2>\u002Fdev\u002Fnull\ncp \"\u002Fmnt\u002Fevidence\u002FProgramData\u002FMicrosoft\u002FWindows\u002FStart Menu\u002FPrograms\u002FStartup\"\u002F*.lnk \\\n   \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fstartup\u002F 2>\u002Fdev\u002Fnull\n\n# Find all LNK files on the system\nfind \u002Fmnt\u002Fevidence\u002F -name \"*.lnk\" -type f 2>\u002Fdev\u002Fnull > \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fall_lnk_locations.txt\n\n# Count and hash\nls \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F | wc -l\nsha256sum \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F*.lnk > \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Flnk_hashes.txt 2>\u002Fdev\u002Fnull\n```\n\n### Step 2: Parse LNK Files with LECmd\n\n```bash\n# Using Eric Zimmerman's LECmd (Windows or via Mono)\n# Process all LNK files in a directory\nLECmd.exe -d \"C:\\cases\\lnk\\recent\\\" --csv \"C:\\cases\\analysis\\\" --csvf lnk_analysis.csv\n\n# Process a single LNK file with verbose output\nLECmd.exe -f \"C:\\cases\\lnk\\recent\\document.pdf.lnk\"\n\n# Process Jump List files\nJLECmd.exe -d \"C:\\cases\\lnk\\recent\\\" --csv \"C:\\cases\\analysis\\\" --csvf jumplist_analysis.csv\n\n# Output includes:\n# - Source file path\n# - Target path (file that was accessed)\n# - Target creation, modification, access timestamps\n# - LNK creation and modification timestamps\n# - Working directory\n# - Command line arguments\n# - Volume serial number and label\n# - Drive type (Fixed, Removable, Network)\n# - Machine ID (NetBIOS name)\n# - MAC address (from tracker database)\n# - File size of target\n```\n\n### Step 3: Parse LNK Files with Python\n\n```bash\npip install LnkParse3\n\npython3 \u003C\u003C 'PYEOF'\nimport LnkParse3\nimport os, json, csv\nfrom datetime import datetime\n\nlnk_dir = '\u002Fcases\u002Fcase-2024-001\u002Flnk\u002Frecent\u002F'\nresults = []\n\nfor filename in sorted(os.listdir(lnk_dir)):\n    if not filename.lower().endswith('.lnk'):\n        continue\n\n    filepath = os.path.join(lnk_dir, filename)\n    try:\n        with open(filepath, 'rb') as f:\n            lnk = LnkParse3.lnk_file(f)\n            info = lnk.get_json()\n\n            parsed = {\n                'lnk_file': filename,\n                'target_path': '',\n                'working_dir': '',\n                'arguments': '',\n                'target_created': '',\n                'target_modified': '',\n                'target_accessed': '',\n                'file_size': '',\n                'drive_type': '',\n                'volume_serial': '',\n                'volume_label': '',\n                'machine_id': '',\n                'mac_address': '',\n            }\n\n            # Extract header timestamps\n            header = info.get('header', {})\n            parsed['target_created'] = str(header.get('creation_time', ''))\n            parsed['target_modified'] = str(header.get('modified_time', ''))\n            parsed['target_accessed'] = str(header.get('accessed_time', ''))\n            parsed['file_size'] = str(header.get('file_size', ''))\n\n            # Extract link info\n            link_info = info.get('link_info', {})\n            if link_info:\n                local_path = link_info.get('local_base_path', '')\n                network_path = link_info.get('common_network_relative_link', {}).get('net_name', '')\n                parsed['target_path'] = local_path or network_path\n\n                vol_info = link_info.get('volume_id', {})\n                if vol_info:\n                    parsed['drive_type'] = str(vol_info.get('drive_type', ''))\n                    parsed['volume_serial'] = str(vol_info.get('drive_serial_number', ''))\n                    parsed['volume_label'] = str(vol_info.get('volume_label', ''))\n\n            # Extract string data\n            string_data = info.get('string_data', {})\n            parsed['working_dir'] = str(string_data.get('working_dir', ''))\n            parsed['arguments'] = str(string_data.get('command_line_arguments', ''))\n\n            # Extract tracker data (machine ID and MAC)\n            extra = info.get('extra', {})\n            tracker = extra.get('DISTRIBUTED_LINK_TRACKER_BLOCK', {})\n            if tracker:\n                parsed['machine_id'] = str(tracker.get('machine_id', ''))\n                parsed['mac_address'] = str(tracker.get('mac_address', ''))\n\n            results.append(parsed)\n\n            # Print summary\n            print(f\"\\n{filename}\")\n            print(f\"  Target: {parsed['target_path']}\")\n            print(f\"  Modified: {parsed['target_modified']}\")\n            print(f\"  Drive: {parsed['drive_type']} (Serial: {parsed['volume_serial']})\")\n            if parsed['machine_id']:\n                print(f\"  Machine: {parsed['machine_id']}\")\n\n    except Exception as e:\n        print(f\"  Error parsing {filename}: {e}\")\n\n# Write results to CSV\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flnk_analysis.csv', 'w', newline='') as f:\n    writer = csv.DictWriter(f, fieldnames=results[0].keys() if results else [])\n    writer.writeheader()\n    writer.writerows(results)\n\nprint(f\"\\n\\nTotal LNK files parsed: {len(results)}\")\nPYEOF\n```\n\n### Step 4: Analyze for Investigative Value\n\n```bash\n# Identify files accessed from removable media\npython3 \u003C\u003C 'PYEOF'\nimport csv\n\nwith open('\u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flnk_analysis.csv') as f:\n    reader = csv.DictReader(f)\n\n    print(\"=== FILES ACCESSED FROM REMOVABLE MEDIA ===\\n\")\n    removable = []\n    network = []\n\n    for row in reader:\n        if 'DRIVE_REMOVABLE' in row.get('drive_type', '').upper() or \\\n           'removable' in row.get('drive_type', '').lower():\n            removable.append(row)\n            print(f\"  {row['target_modified']} | {row['target_path']} | Vol: {row['volume_serial']}\")\n\n        if 'network' in row.get('drive_type', '').lower() or \\\n           row.get('target_path', '').startswith('\\\\\\\\'):\n            network.append(row)\n\n    print(f\"\\n=== FILES ACCESSED FROM NETWORK SHARES ===\\n\")\n    for row in network:\n        print(f\"  {row['target_modified']} | {row['target_path']}\")\n\n    print(f\"\\nRemovable media files: {len(removable)}\")\n    print(f\"Network share files: {len(network)}\")\n\n    # Check for unique machines (tracker data)\n    machines = set()\n    for row in [*removable, *network]:\n        if row.get('machine_id'):\n            machines.add(row['machine_id'])\n    if machines:\n        print(f\"\\nMachine IDs found: {machines}\")\nPYEOF\n\n# Check Startup folder LNK files for persistence\necho \"=== STARTUP FOLDER SHORTCUTS (PERSISTENCE) ===\" > \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_persistence.txt\nfor lnk in \u002Fcases\u002Fcase-2024-001\u002Flnk\u002Fstartup\u002F*.lnk; do\n    python3 -c \"\nimport LnkParse3\nwith open('$lnk', 'rb') as f:\n    lnk = LnkParse3.lnk_file(f)\n    info = lnk.get_json()\n    target = info.get('link_info', {}).get('local_base_path', 'Unknown')\n    args = info.get('string_data', {}).get('command_line_arguments', '')\n    print(f'  $(basename $lnk): {target} {args}')\n\" >> \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Fstartup_persistence.txt 2>\u002Fdev\u002Fnull\ndone\n```\n\n## Key Concepts\n\n| Concept | Description |\n|---------|-------------|\n| Shell Link (.lnk) | Windows shortcut file format containing target path, timestamps, and metadata |\n| Target timestamps | Creation, modification, and access times of the file the shortcut points to |\n| Volume serial number | Unique identifier of the drive volume where the target file resides |\n| Machine ID | NetBIOS name embedded by the Distributed Link Tracking service |\n| MAC address | Network adapter MAC from the machine that created the LNK file |\n| Jump Lists | Recent and pinned file lists per application (contain embedded LNK data) |\n| Automatic Destinations | System-managed Jump List entries for recently opened files |\n| Custom Destinations | User-pinned Jump List items that persist until manually removed |\n\n## Tools & Systems\n\n| Tool | Purpose |\n|------|---------|\n| LECmd | Eric Zimmerman command-line LNK file parser with CSV\u002FJSON output |\n| JLECmd | Eric Zimmerman Jump List parser |\n| LnkParse3 | Python library for programmatic LNK file analysis |\n| lnk_parser | Alternative Python LNK parsing tool |\n| Autopsy | Forensic platform with LNK file analysis module |\n| KAPE | Automated LNK and Jump List artifact collection |\n| Plaso | Timeline tool with LNK file parser for super-timeline creation |\n| LNK Explorer | GUI tool for interactive LNK file examination |\n\n## Common Scenarios\n\n**Scenario 1: Data Exfiltration via USB Drive**\nAnalyze Recent folder LNK files for targets on removable drives, correlate volume serial numbers with USBSTOR registry entries, build a list of files accessed from USB devices, establish which documents were opened from the removable drive, correlate with file copy timestamps.\n\n**Scenario 2: Malware Persistence via Startup Shortcuts**\nExamine Startup folder LNK files for malicious targets, check target path and arguments for encoded commands or suspicious executables, verify target file exists and examine it, correlate creation timestamp with initial compromise time.\n\n**Scenario 3: Network Share Access Investigation**\nFilter LNK files with network paths (UNC targets), identify which network shares were accessed and when, correlate machine IDs with known corporate systems, check if sensitive file servers were accessed outside of normal duties, build access timeline for compliance investigation.\n\n**Scenario 4: Document Access Timeline for Legal Proceedings**\nExtract all Recent folder LNK files, build chronological list of documents accessed by the user, identify specific files relevant to the case, present target timestamps showing when files were opened, correlate with email and communication timelines.\n\n## Output Format\n\n```\nLNK File Analysis Summary:\n  User Profile: suspect_user\n  Total LNK Files: 234 (Recent: 198, Desktop: 23, Startup: 5, Other: 8)\n\n  File Access Statistics:\n    Local drive (C:):    156 files\n    Removable media:     23 files (3 unique volume serials)\n    Network shares:      15 files (\\\\server01, \\\\fileserver)\n    Other drives:        4 files\n\n  Machine IDs Found: DESKTOP-ABC123, LAPTOP-XYZ789\n  MAC Addresses: AA:BB:CC:DD:EE:FF, 11:22:33:44:55:66\n\n  Removable Media Access:\n    Volume Serial 1234-ABCD:\n      2024-01-15 14:32 - E:\\Confidential\\financial_report.xlsx\n      2024-01-15 14:45 - E:\\Confidential\\customer_database.csv\n      2024-01-15 15:00 - E:\\Projects\\source_code.zip\n\n  Startup Persistence:\n    updater.lnk -> C:\\ProgramData\\svc\\updater.exe (SUSPICIOUS)\n    OneDrive.lnk -> C:\\Users\\...\\OneDrive.exe (Legitimate)\n\n  Timeline: \u002Fcases\u002Fcase-2024-001\u002Fanalysis\u002Flnk_analysis.csv\n```\n",{"name":5,"tags":25,"author":32,"domain":33,"license":15,"version":34,"subdomain":35,"description":7},[26,27,28,29,30,31],"forensics","lnk-files","windows-artifacts","shortcut-analysis","timeline-reconstruction","evidence-collection","mahipal","cybersecurity","1.0","digital-forensics","main","99825ad3f3bcc6597ddcc7294a14e6e922f2b67b","skills\u002Fanalyzing-windows-lnk-files-for-artifacts",0,"https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills","https:\u002F\u002Fgithub.com\u002Fjukeyman","https:\u002F\u002FRJBUSINESSSOLUTIONS.ORG","Credit and Finance Expert | Developer\r\n\r\nI'm Rick Jefferson, a seasoned credit and finance expert with over a decade of experience in financial literacy,","2026-07-13 07:03:29",{"source":8,"skillName":5,"commands":46,"prompt":56,"zipAvailable":57},[47,50,53],{"tool":48,"command":49},"npx","npx skills add jukeyman\u002Fjukeyman-skills --skill analyzing-windows-lnk-files-for-artifacts",{"tool":51,"command":52},"bunx","bunx skills add jukeyman\u002Fjukeyman-skills --skill analyzing-windows-lnk-files-for-artifacts",{"tool":54,"command":55},"pnpm","pnpm dlx skills add jukeyman\u002Fjukeyman-skills --skill analyzing-windows-lnk-files-for-artifacts","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-windows-lnk-files-for-artifacts\u002FSKILL.md",true,[59,63,69],{"path":60,"resourceType":60,"resourceTypeDesc":61,"sizeBytes":62,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":64,"resourceType":65,"resourceTypeDesc":66,"sizeBytes":67,"sourceHtmlUrl":68},"references\u002Fapi-reference.md","REFERENCE","参考文档",2301,"https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-windows-lnk-files-for-artifacts\u002Freferences\u002Fapi-reference.md",{"path":70,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":74},"scripts\u002Fagent.py","SCRIPT","脚本",6645,"https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fanalyzing-windows-lnk-files-for-artifacts\u002Fscripts\u002Fagent.py",[76,84,91,98,105,113],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":6,"sourceHtmlUrl":81,"categories":82,"keywords":83,"publishedAt":20},"01M79ANS2SM329NEP5ZCX106RR","zustand-store-creator","Create zustand store creator operations. Auto-activating skill for Frontend Development.\nTriggers on: zustand store creator, zustand store creator\nPart of the Frontend Development skill category. Use when working with zustand store creator functionality. Trigger with phrases like \"zustand store creator\", \"zustand creator\", \"zustand\".","MIT","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzustand-store-creator\u002FSKILL.md",[],[],{"skillNo":85,"name":86,"nameZh":6,"description":87,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":6,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":20},"01M79AMZKP4YDEZ7EHG1Y7PP74","zero-trust-config-helper","Configure with zero trust config helper operations. Auto-activating skill for Security Advanced.\nTriggers on: zero trust config helper, zero trust config helper\nPart of the Security Advanced skill category. Use when configuring systems or services. Trigger with phrases like \"zero trust config helper\", \"zero helper\", \"zero\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzero-trust-config-helper\u002FSKILL.md",[],[],{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":20},"01M79AMJSBCEJQNBTYNAHYN5HM","zapier-integration-helper","Assist with zapier integration helper operations. Auto-activating skill for Business Automation.\nTriggers on: zapier integration helper, zapier integration helper\nPart of the Business Automation skill category. Use when working with APIs or building integrations. Trigger with phrases like \"zapier integration helper\", \"zapier helper\", \"zapier\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fzapier-integration-helper\u002FSKILL.md",[],[],{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":104,"publishedAt":20},"01M79AHJZGVMARS13VFQYRR1MP","yaml-config-validator","Validate yaml config validator operations. Auto-activating skill for DevOps Basics.\nTriggers on: yaml config validator, yaml config validator\nPart of the DevOps Basics skill category. Use when configuring systems or services. Trigger with phrases like \"yaml config validator\", \"yaml validator\", \"yaml\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fyaml-config-validator\u002FSKILL.md",[],[],{"skillNo":106,"name":107,"nameZh":6,"description":108,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":109,"sourceHtmlUrl":110,"categories":111,"keywords":112,"publishedAt":20},"01M79AHGDZRN0020RDQSQDPAM8","xvary-stock-research","Thesis-driven equity analysis from public SEC EDGAR and market data; \u002Fanalyze, \u002Fscore, \u002Fcompare workflows with bundled Python tools (Claude Code, Cursor, Codex).","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxvary-stock-research\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxvary-stock-research\u002FSKILL.md",[],[],{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":80,"licenseFileUrl":6,"sourceHtmlUrl":117,"categories":118,"keywords":119,"publishedAt":20},"01M79AHCYJ9FV9RMHQ24HDRN33","xss-vulnerability-scanner","Scan xss vulnerability scanner operations. Auto-activating skill for Security Fundamentals.\nTriggers on: xss vulnerability scanner, xss vulnerability scanner\nPart of the Security Fundamentals skill category. Use when working with xss vulnerability scanner functionality. Trigger with phrases like \"xss vulnerability scanner\", \"xss scanner\", \"xss\".","https:\u002F\u002Fgithub.com\u002Fjukeyman\u002Fjukeyman-skills\u002Fblob\u002Fmain\u002Fskills\u002Fxss-vulnerability-scanner\u002FSKILL.md",[],[]]