TrackView.lnk appears to be a compressed file. Therefore the technical security rating is 66% dangerous. Recommended: Identify TrackView.lnk related errors. If TrackView.lnk is located in a subfolder of 'C: Program Files', the security rating is 66% dangerous. The file size is 1,169 bytes (50% of all occurrences) or 1,072 bytes. Interestingly, the LNK file does not appear to have a TrackerDataBlock, and as such, there is no machine ID (system NetBIOS name) embedded in the LNK file. Again, this is pretty easy to verify via a hex editor. What we have so far is a pretty interesting view into the manufacture of this LNK file. XPS Viewer.lnk uses the LNK file extension, which is more specifically known as a Windows File Shortcut file. It is classified as a LNK (Windows File Shortcut) file, created for Microsoft Office Access 2010 14 by Microsoft. The release of XPS Viewer.lnk introduced for Windows was on in Windows 7. Restarting File Explorer and the older Windows Explorer can be done in Task Manager End Task, right-click Windows Explorer then click Restart then wait or simply reboot the computer. I now use Sordum.org 's Restart Explorer because it saves any open folders then re-opens them again after Explorer restarts. Easy Link File Viewer is a simple program to open, modify and write shortcut (.lnk) files with ease. It is an alternative to the built-in shell-extension included in Windows operating system.
- Lnk File Viewer For Mac
- Lnk File Reader Download
- Lnk File Viewer App
- Lnk File Viewer Free
- Lnk File Viewer Download
- Lnk File Viewer Extension
Lnk File Viewer For Mac
What?
.LNK is the extension used by Shortcut Files in Windows. We normally place a ton of shortcuts on our desktop and sometimes in other folders as well. These shortcuts (LNK) files are binary files that contain information needed by windows to access the target file or folder.
A lnk file contains information like:
Lnk File Reader Download
- Local Base Path to the Target file
- This is the folder/file which the LNK file is pointing to
- MAC Times for the LNK file
- The timestamps when the LNK file was created, modified and last accessed
- File size of the LNK File
- Keyboard shortcut for the LNK file
- The LNK file can be associated with a keyboard shortcut. When the specific keys are pressed, the LNK file can be run
- Argument list for the LNK file
- Windows can pass certain command line arguments to the target file via the LNK file
Why?
Even though the destination application may have been deleted/moved, their shortcuts can still remain. This can help forensic investigators understand what was executed/accessed on the system.
How?
Powerforensics is a PowerShell framework created for Hard Drive Forensic analysis by Jared Atkinson
In order to use it, we need to install the PowerForensics module and import it.
2 |
We can use the Get-ForensicShellLink cmdlet of PowerForensics for performing an analysis on LNK Files.
To view some examples of using GFS, we use the below command
To view a list of parameters, we use the below command
Path should point to the path of the LNK file we want to investigate.
Volume will be the drive letter to scan and analyze for LNK files. If we do not specify any parameter, it will scan through the current drive for LNK files
VOLUME BASED
Using FTK Imager, we have mounted a forensic image as a read only H: drive. Using GFS, we can parse the entire image, find the LNK files and output the result to Excel using the ImportExcel PowerShell module
Get-ForensicShellLink-PathC:Userslenovo2DesktopRemnux.lnk |
We can see that:
--startvm
takes the guid of the virtualbox vm to start--comment
is a description
Lnk File Viewer App
Lnk File Viewer Free
We can pipe the output to Get-ForensicFileRecord to get more details about the LNK file and its target file