LNK File
Definition
A Windows shortcut that records the target path, target MAC times, the source volume serial number, and the MAC address of the host that created the shortcut. Persists in Recent\ folders even after the target is deleted.
- Platform
- Windows
- Records
- Target path, target MAC times, source volume serial number
- Also records
- MAC address of the host that created the shortcut
- Persistence
- Remains in Recent\ after the target file is deleted
Common questions
Why are LNK files useful when the target file has been deleted?+
The shortcut retains the original file path, timestamps, and volume serial number, giving evidence that the file once existed and where it lived even after the target itself is gone.
What does the MAC address embedded in an LNK file indicate?+
It identifies the network adapter of the machine that created the shortcut, which is useful for tying a file's access, such as one opened from removable media, back to a specific host.
Related terms
- Alternate Data Stream (ADS)
- An NTFS feature that lets a file carry one or more named streams in addition to its default stream, accessed as filename.txt:streamname....
- File Slack
- The unused space at the tail of the last cluster of a file. It can contain remnants of whatever previously occupied that...
- Hiberfil.sys
- The compressed RAM snapshot Windows writes to C:\ when the system hibernates. Recoverable as a memory image with Hibr2Bin or Volatility, often...
- ShellBags
- Registry keys under Software\Microsoft\Windows\Shell\BagMRU and \Bags in UsrClass.dat and NTUSER.DAT that record every folder the user opened in Explorer, including folders on...
- Volume Shadow Copy (VSS)
- Block-level snapshots of NTFS volumes maintained by the Volume Shadow Copy Service for System Restore and backup. Recoverable with vss-tools, ShadowExplorer, KAPE,...