Shortcut (LNK) Files

Description: Shortcut Files automatically created by Windows Recent Items Opening local and remote data files and documents will generate a shortcut file (.lnk)

Location:

• C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent\
• C:\Users\<username>\AppData\Roaming\Microsoft\Office\Recent\

Notes:

• Date/Time file of that name was first opened:
  • Creation Date of Shortcut (LNK) File
• Date/Time file of that name was last opened:
  • Last Modification Date of Shortcut (LNK) File
• LNKTarget File (Internal LNK File Information) Data:
  • Modified, Access, and Creation times of the target file.
  • Volume Information (Name, Type, Serial Number)
  • Network Share information
  • Original Location
  • Name of System

Analysis:
Coming Soon!