-
Notifications
You must be signed in to change notification settings - Fork 189
/
LNKFilesAndJumpLists.tkape
56 lines (55 loc) · 1.9 KB
/
LNKFilesAndJumpLists.tkape
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
Description: LNK Files and jump lists
Author: Eric Zimmerman, Andrew Rathbun, Yogesh Khatri
Version: 1.3
Id: 2e354bdc-e418-438e-8439-c21c83c64e90
RecreateDirectories: true
Targets:
-
Name: LNK Files from Recent
Category: LNKFiles
Path: C:\Users\%user%\AppData\Roaming\Microsoft\Windows\Recent\
Recursive: true
Comment: Also includes automatic and custom jumplist directories
-
Name: LNK Files from Microsoft Office Recent
Category: LNKFiles
Path: C:\Users\%user%\AppData\Roaming\Microsoft\Office\Recent\
Recursive: true
-
Name: Start Menu LNK Files
Category: LNKFiles
Path: C:\Users\%user%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
FileMask: '*.LNK'
-
Name: LNK Files from Recent (XP)
Category: LNKFiles
Path: C:\Documents and Settings\%user%\Recent\
Recursive: true
-
Name: Desktop LNK Files XP
Category: LNKFiles
Path: C:\Documents and Settings\%user%\Desktop\
FileMask: '*.LNK'
-
Name: Desktop LNK Files
Category: LNKFiles
Path: C:\Users\%user%\Desktop\
FileMask: '*.LNK'
-
Name: Restore point LNK Files XP
Category: LNKFiles
Path: C:\System Volume Information\_restore*\RP*\
FileMask: '*.LNK'
-
Name: LNK Files from C:\ProgramData
Category: LNKFiles
Path: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
FileMask: '*.LNK'
# Documentation
# https://www.sans.org/security-resources/posters/windows-forensic-analysis/170/download
# https://www.youtube.com/watch?v=g1zYCvzhBS4
# https://belkasoft.com/forensic-analysis-of-lnk-files
# http://windowsir.blogspot.com/2017/05/use-of-lnk-filesagain.html
# https://dfir.pubpub.org/pub/wfuxlu9v
# https://www.forensafe.com/blogs/jumplist.html
# https://www.forensafe.com/blogs/lnkfile.html