top of page

Analysis of LNK Files

Data on which programs were last run on a computer and which files were logged in and out can be useful to us in many ways. We can use this data to resolve various security concerns, or even to satisfy our curiosity when we get it back from a friend we entrusted the computer to.


The files viewed by the user in the Windows operating system are always stored under the name of "Recent Files".


With this recording unit, it is extremely easy to access the last files accessed. Even files deleted by the user are recorded by the computer as shortcuts.



To access link files with LNK extension;


We have to follow the steps of Users\UserName\AppData\Roaming\Microsoft\Windows\Recent.




Which files are recorded in the LNK file?


  • Full path to the target file or directory pointed to by the LNK file

  • Information when the target file or directory was created, modified and accessed

  • Size of the target file or directory

  • NETBIOS name and MAC address of the target system

  • Serial number of the volume where the target file or directory is stored

  • Network share name if the target file and directory is accessed over the network

  • Attributes of the target file or directory (for example, 'read only', 'hidden', 'system')


Also, we can use practical programs such as "Windows File Analyzer" and "Lnkanalyser" to access information about previously accessed files.



In addition to the information about the creation, access dates, driver name and serial numbers of the files that are logged in and out of your computer at various dates range, you can also find the normally hidden details such as the network path and the name of the network path adapter.


lnkanalyser

The Windows File Analyzer program quickly collects all kinds of information about certain files on your computer and turns it into a table. The program's multiple tabs allow us to perform more than one analysis at the same time.



https://www .raymond.cc/blog/download/did/3750/ Thanks to the program that we can install via the link;


The file's creation and last access dates can also be viewed in detail.


As you can see in the picture above, thanks to "Shortcut Analysis", we can access various information about recently opened files on a single page.

bottom of page