Posts tagged: #digital forensics

A short, technical tour of the Windows Shell Link (.lnk) binary format: its header, link flags, LinkInfo, StringData and ExtraData blocks, plus what this client-side parser extracts from each one.