Glossary
LNK forensics
The analysis of Windows .lnk shortcut files as digital evidence, recovering target paths, timestamps and volume identifiers left behind by user activity.
LNK forensics is the practice of examining Windows shortcut files as
evidence. Windows automatically creates .lnk files (for example in Recent
Items) when a user opens a document, and each one records the target path,
MAC timestamps, file size, volume serial number and sometimes network share
details. Investigators use these artefacts to prove that a specific file existed
and was accessed, even after the original is deleted. Parsing the shortcut
client-side keeps potential malware inert while you read its metadata.