.LNK

Introduction

A .lnk file is a Windows shortcut: the icons on the desktop and in the Start menu that open a program, file or folder stored somewhere else. Windows hides the extension, so a shortcut shows only its name and an arrow on its icon. Microsoft documents the format as the Shell Link Binary File Format, MS-SHLLINK.

As well as the target’s path, a shortcut records the target’s size and times, the volume it was on and often the name of the computer. Forensic investigators read shortcuts to learn which files were opened and when.

Software

• Windows File Explorer, which follows shortcuts and edits them in their Properties
• LECmd, Eric Zimmerman’s shortcut parser (Windows)

Structure

A shortcut starts with a 76-byte ShellLinkHeader. Its first four bytes give the header size, 0x4C, followed by a fixed class ID, so every shortcut starts with 4C 00 00 00 01 14 02 00. The header then holds the link flags, the target’s file attributes, its creation, access and write times, its size, the icon index, the window state to open it in and a hot key. All values are little-endian.

The link flags say which optional parts follow. The LinkTargetIDList holds the target as a shell item list. LinkInfo holds the local path and volume details, or the network share. StringData holds counted strings: a description, a relative path, the working directory, command line arguments and the icon’s location. Extra data blocks close the file, such as the tracker block with the machine name and the environment variables block.