How does this help in detecting data exfiltration?

It identifies LNK files pointing to targets on removable drives (USB) and correlates volume serial numbers with system registry entries to prove file access from external media.

Which forensic tools does this skill support?

The skill provides workflows for Eric Zimmerman's LECmd and JLECmd, as well as Python-based libraries like LnkParse3 for programmatic analysis.

What information can be extracted from a Windows LNK file?

LNK files contain target file paths, creation/modification/access timestamps, volume serial numbers, machine names (NetBIOS), and sometimes the MAC address of the source machine.

Can this skill analyze Jump Lists?

Yes, it includes procedures for parsing Automatic and Custom Destinations, which contain embedded LNK data representing recently or pinned files per application.

Is this skill useful for malware investigations?

Absolutely. It helps investigators identify malicious shortcuts in Startup folders or Jump Lists that points to encoded commands or suspicious executables used for persistence.

Windows LNK Forensics Analyzer

Name: Windows LNK Forensics Analyzer
Author: micsapp

bymicsapp

0•

安全与测试

Extracts and analyzes Windows LNK shortcut files to reconstruct file access history, identify external media usage, and build forensic timelines.

This skill provides specialized guidance for digital forensic investigators to parse and interpret Windows Shell Link (.lnk) files and Jump Lists. It enables the extraction of critical metadata, including target paths, creation/modification timestamps, volume serial numbers, and machine identifiers. By leveraging industry-standard tools like LECmd and Python libraries, the skill helps investigators efficiently trace user activity, detect unauthorized data exfiltration via USB devices, and identify persistence mechanisms used by malware in system startup folders.

主要功能

01Extraction of target timestamps and file system metadata

02Analysis of Machine IDs and MAC addresses from tracker data

030 GitHub stars

04Identification of removable media and network share access

05Automated LNK and Jump List artifact collection and parsing

06Forensic timeline reconstruction for file and document access

使用场景

01Investigating data exfiltration via USB drives and external media

02Detecting malware persistence in Windows Startup directories

03Reconstructing user document access history for legal or internal audits

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills analyzing-windows-lnk-files-for-artifacts

For use in Claude.ai and ChatGPT

主要功能

01Extraction of target timestamps and file system metadata

02Analysis of Machine IDs and MAC addresses from tracker data

030 GitHub stars

04Identification of removable media and network share access

05Automated LNK and Jump List artifact collection and parsing

06Forensic timeline reconstruction for file and document access

使用场景

01Investigating data exfiltration via USB drives and external media

02Detecting malware persistence in Windows Startup directories

03Reconstructing user document access history for legal or internal audits

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add micsapp/micstec-skills analyzing-windows-lnk-files-for-artifacts

For use in Claude.ai and ChatGPT