Parses Windows shortcut files to reconstruct user activity, file access history, and forensic timelines.
This skill enables Claude to perform detailed digital forensic analysis of Windows LNK (.lnk) files and Jump Lists. It automates the extraction of critical metadata, including target paths, creation/modification timestamps, volume serial numbers, and machine identifiers. By parsing these artifacts, investigators can reconstruct file access history, identify data exfiltration via removable media, detect malware persistence in startup folders, and correlate user activity with network share access across a forensic timeline.
Key Features
01Parses forensic timestamps for accurate timeline reconstruction
024,121 GitHub stars
03Extracts target file paths and working directories from shortcut files
04Detects indicators of data exfiltration to USB devices or network shares
05Analyzes Jump Lists for recently and frequently accessed applications
06Identifies volume serial numbers and hardware identifiers like Machine IDs
Use Cases
01Detecting malware persistence mechanisms in Windows Startup folders
02Digital forensic investigations for reconstructing user file access history
03Tracking document access from external storage or unauthorized network drives
