Windows LNK Forensics Analyzer

This skill provides specialized guidance for digital forensic investigators to parse and interpret Windows Shell Link (.lnk) files and Jump Lists. It enables the extraction of critical metadata, including target paths, creation/modification timestamps, volume serial numbers, and machine identifiers. By leveraging industry-standard tools like LECmd and Python libraries, the skill helps investigators efficiently trace user activity, detect unauthorized data exfiltration via USB devices, and identify persistence mechanisms used by malware in system startup folders.

Key Features

Use Cases