LNK shortcuts

Location & availability

User Recent items, Desktop, Start Menu and other locations containing .lnk files

Shortcuts can be created automatically, copied or made manually. Their meaning depends on origin and context.

Fields to examine

• Target path or shell item identifiers.
• Volume information and working directory where present.
• Shortcut file timestamps versus target timestamps copied into its structure.

What it can establish

• Support a stored shortcut-to-target relationship.
• Add path, volume or recent-item context for a profile.

What it cannot prove

• Prove execution merely because a shortcut exists.
• Treat copied target timestamps as the time the user opened the shortcut.

Use it in a screenshare

1. Collect the actual .lnk file and record its location within the profile.
2. Parse it with LECmd, separating target fields from the .lnk file’s own metadata.
3. Correlate relevant Recent items with Jump Lists, UserAssist or program events, and examine whether the link was copied from elsewhere.

Worked example

A Recent shortcut points to a file on a removable volume. It supports a target association within that profile. It does not prove that today’s drive letter maps to the same device or that the target was executed.

Cross-check the finding

• Jump Lists →Support an application/destination association in the retained data.
• UserAssist →Support shell-associated application activity in a particular profile.
• USBSTOR and USB registry records →Support that the examined host retained an enumeration record for a device identity.

Sources

• Microsoft — Shell Link format ↗
• LECmd — shortcut parser ↗