LNK file format: ShellLinkHeader

Every shortcut starts with a 76-byte header. It fixes the file as a Shell Link and holds most of what Explorer shows in a shortcut’s Properties. All values are little-endian.

Fields

0HeaderSize always 0x4C4
4LinkCLSID always 00021401-0000-0000-C000-00000000004616
20LinkFlags and FileAttributes4 + 4
28CreationTime, AccessTime, WriteTime as FILETIME8 + 8 + 8
52FileSize, IconIndex, ShowCommand4 + 4 + 4
64HotKey, then three reserved fields2 + 2 + 4 + 4

The 76-byte ShellLinkHeader.

Offset	Size	Type	Name	Description
0	4	u32	`HeaderSize`	Must be `0x0000004C`.
4	16	GUID	`LinkCLSID`	Must be `00021401-0000-0000-C000-000000000046`. As bytes: `01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46`.
20	4	u32	`LinkFlags`	Which optional parts are present and how the link behaves. See Link flags.
24	4	u32	`FileAttributes`	The attributes of the target. See File attributes.
28	8	FILETIME	`CreationTime`	When the target was created, UTC. Zero means no time was set.
36	8	FILETIME	`AccessTime`	When the target was last accessed, UTC. Zero means no time was set.
44	8	FILETIME	`WriteTime`	When the target was last written, UTC. Zero means no time was set.
52	4	u32	`FileSize`	The target’s size in bytes. For a larger file, its least significant 32 bits.
56	4	i32	`IconIndex`	Which icon within the icon location.
60	4	u32	`ShowCommand`	The window state to open the target in. See Show command.
64	2	u16	`HotKey`	The key that opens the target. See Hot key.
66	2	u16	`Reserved1`	Must be zero.
68	4	u32	`Reserved2`	Must be zero.
72	4	u32	`Reserved3`	Must be zero.

A FILETIME is two 32-bit values, low then high: 100-nanosecond intervals since 1 January 1601 UTC.

Link flags

Bits 0 to 26 are defined. Bits 27 to 31 must be zero.

Bit	Mask	Name	Meaning
0	`0x00000001`	`HasLinkTargetIDList`	A LinkTargetIDList follows the header.
1	`0x00000002`	`HasLinkInfo`	A LinkInfo structure is present.
2	`0x00000004`	`HasName`	A `NAME_STRING` string is present.
3	`0x00000008`	`HasRelativePath`	A `RELATIVE_PATH` string is present.
4	`0x00000010`	`HasWorkingDir`	A `WORKING_DIR` string is present.
5	`0x00000020`	`HasArguments`	A `COMMAND_LINE_ARGUMENTS` string is present.
6	`0x00000040`	`HasIconLocation`	An `ICON_LOCATION` string is present.
7	`0x00000080`	`IsUnicode`	The strings in StringData are UTF-16; otherwise they use the system default code page.
8	`0x00000100`	`ForceNoLinkInfo`	The LinkInfo is ignored.
9	`0x00000200`	`HasExpString`	An EnvironmentVariableDataBlock is present.
10	`0x00000400`	`RunInSeparateProcess`	A 16-bit target runs in a separate virtual machine.
11	`0x00000800`	`Unused1`	Undefined and must be ignored.
12	`0x00001000`	`HasDarwinID`	A DarwinDataBlock is present.
13	`0x00002000`	`RunAsUser`	The target runs as a different user.
14	`0x00004000`	`HasExpIcon`	An IconEnvironmentDataBlock is present.
15	`0x00008000`	`NoPidlAlias`	The file system location is represented in the shell namespace when the path is parsed into an IDList.
16	`0x00010000`	`Unused2`	Undefined and must be ignored.
17	`0x00020000`	`RunWithShimLayer`	A ShimDataBlock is present.
18	`0x00040000`	`ForceNoLinkTrack`	The TrackerDataBlock is ignored.
19	`0x00080000`	`EnableTargetMetadata`	Target properties are collected into the property store when the target is set.
20	`0x00100000`	`DisableLinkPathTracking`	The EnvironmentVariableDataBlock is ignored.
21	`0x00200000`	`DisableKnownFolderTracking`	The SpecialFolderDataBlock and KnownFolderDataBlock are ignored on load.
22	`0x00400000`	`DisableKnownFolderAlias`	With a KnownFolderDataBlock, the unaliased form of the known folder IDList should be used on load.
23	`0x00800000`	`AllowLinkToLink`	A link may refer to another link.
24	`0x01000000`	`UnaliasOnSave`	When saving, use the unaliased form of a known folder, or the target IDList.
25	`0x02000000`	`PreferEnvironmentPath`	Refer to the target through the EnvironmentVariableDataBlock path instead of storing the IDList.
26	`0x04000000`	`KeepLocalIDListForUNCTarget`	For a UNC name on the local machine, keep the local path IDList in the property store.

File attributes

The attributes of the target when the link was made. They may be out of date.

Bit	Mask	Name	Meaning
0	`0x0001`	`READONLY`	The target is read-only.
1	`0x0002`	`HIDDEN`	The target is hidden.
2	`0x0004`	`SYSTEM`	Part of the operating system, or used only by it.
3	`0x0008`	Reserved	Must be zero.
4	`0x0010`	`DIRECTORY`	The target is a directory.
5	`0x0020`	`ARCHIVE`	Marked for backup or removal.
6	`0x0040`	Reserved	Must be zero.
7	`0x0080`	`NORMAL`	No other flags are set.
8	`0x0100`	`TEMPORARY`	Used for temporary storage.
9	`0x0200`	`SPARSE_FILE`	A sparse file.
10	`0x0400`	`REPARSE_POINT`	Has an associated reparse point.
11	`0x0800`	`COMPRESSED`	Compressed.
12	`0x1000`	`OFFLINE`	The data is not immediately available.
13	`0x2000`	`NOT_CONTENT_INDEXED`	Whether the content needs to be indexed.
14	`0x4000`	`ENCRYPTED`	Encrypted.

Show command

Value	Name	Meaning
1	`SW_SHOWNORMAL`	A normal window.
3	`SW_SHOWMAXIMIZED`	Maximised.
7	`SW_SHOWMINNOACTIVE`	Minimised, without the keyboard focus.

Any other value is treated as SW_SHOWNORMAL.

Hot key

Two bytes. The low byte is a virtual key code, the high byte the modifier keys.

Low byte	Key
`0x00`	No key assigned
`0x30`–`0x39`	The keys 0 to 9
`0x41`–`0x5A`	The keys A to Z
`0x70`–`0x87`	F1 to F24
`0x90`	Num Lock
`0x91`	Scroll Lock

High byte	Modifier
`0x00`	None
`0x01`	Shift
`0x02`	Ctrl
`0x04`	Alt

.LNK File Format – ShellLinkHeader

Fields

Link flags

File attributes

Show command

Hot key