Lnk File Viewer



TrackView.lnk appears to be a compressed file. Therefore the technical security rating is 66% dangerous. Recommended: Identify TrackView.lnk related errors. If TrackView.lnk is located in a subfolder of 'C: Program Files', the security rating is 66% dangerous. The file size is 1,169 bytes (50% of all occurrences) or 1,072 bytes. Interestingly, the LNK file does not appear to have a TrackerDataBlock, and as such, there is no machine ID (system NetBIOS name) embedded in the LNK file. Again, this is pretty easy to verify via a hex editor. What we have so far is a pretty interesting view into the manufacture of this LNK file. XPS Viewer.lnk uses the LNK file extension, which is more specifically known as a Windows File Shortcut file. It is classified as a LNK (Windows File Shortcut) file, created for Microsoft Office Access 2010 14 by Microsoft. The release of XPS Viewer.lnk introduced for Windows was on in Windows 7. Restarting File Explorer and the older Windows Explorer can be done in Task Manager End Task, right-click Windows Explorer then click Restart then wait or simply reboot the computer. I now use Sordum.org 's Restart Explorer because it saves any open folders then re-opens them again after Explorer restarts. Easy Link File Viewer is a simple program to open, modify and write shortcut (.lnk) files with ease. It is an alternative to the built-in shell-extension included in Windows operating system.

  1. Lnk File Viewer For Mac
  2. Lnk File Reader Download
  3. Lnk File Viewer App
  4. Lnk File Viewer Free
  5. Lnk File Viewer Download
  6. Lnk File Viewer Extension

Lnk File Viewer For Mac

What?

.LNK is the extension used by Shortcut Files in Windows. We normally place a ton of shortcuts on our desktop and sometimes in other folders as well. These shortcuts (LNK) files are binary files that contain information needed by windows to access the target file or folder.

A lnk file contains information like:

Lnk File Reader Download

  • Local Base Path to the Target file
    • This is the folder/file which the LNK file is pointing to
  • MAC Times for the LNK file
    • The timestamps when the LNK file was created, modified and last accessed
  • File size of the LNK File
  • Keyboard shortcut for the LNK file
    • The LNK file can be associated with a keyboard shortcut. When the specific keys are pressed, the LNK file can be run
  • Argument list for the LNK file
    • Windows can pass certain command line arguments to the target file via the LNK file

Why?

Even though the destination application may have been deleted/moved, their shortcuts can still remain. This can help forensic investigators understand what was executed/accessed on the system.

How?

Powerforensics is a PowerShell framework created for Hard Drive Forensic analysis by Jared Atkinson

In order to use it, we need to install the PowerForensics module and import it.

Lnk File Viewer
Get-ForensicShellLink-VolumeName.H:|Export-Exceldemo.csv-AutoSize-FreezeTopRow

Above command will create an excel file named demo.csv whose column will be auto-sized and a frozen top row

Analysing the above we can conclude:

  • FileSize for LNK to folders will always be0 [My Pictures Lorpix]
  • Working directory points to Z:Lorpix . Lorpix could be a folder on a shared network folder mapped as Z:. We can investigate the Hive files to find the network path
  • CommonPathSuffix gives us more information about the target file locations

Path Based

Here, Remnux is a shortcut on my desktop to a virtual machine in virtualbox. We can analyze it by using:

Lnk File Viewer Extension

2
Get-ForensicShellLink-PathC:Userslenovo2DesktopRemnux.lnk
Get-ForensicShellLink-PathC:Userslenovo2DesktopRemnux.lnk|Get-ForensicFileRecord-Path{$_.LocalBasePath}