Analyze Windows LNK shortcut files and Jump List artifacts with LECmd, JLECmd, and manual Shell Link Binary Format parsing to establish evidence of file access, program execution, and user activity that persists even after the target file is deleted. Use when investigating Windows user activity, rec

Analyzing LNK File and Jump List Artifacts Overview Windows LNK (shortcut) files and Jump Lists are critical forensic artifacts that provide evidence of file access, program execution, and user behavior. LNK files are created automatically when a user opens a file through Windows Explorer or the Open/Save dialog, storing metadata about the target file including its original path, timestamps, volume serial number, NetBIOS name, and MAC address of the host system. Jump Lists, introduced in Windows 7, extend this by maintaining per application lists of recently and frequently accessed files. These artifacts persist even after the target files are deleted, making them invaluable for establishing that a user accessed specific files at specific times. When to Use When investigating security incidents that require analyzing lnk file and jump list artifacts When building detection rules or threat hunting queries for this domain When SOC analysts need structured procedures for this analysis type When validating security monitoring coverage for related attack techniques Prerequisites LECmd (Eric Zimmerman) for LNK file parsing JLECmd (Eric Zimmerman) for Jump List parsing Python 3.8+ with pylnk3 or LnkParse3 libraries Forensic image or triage collection from Windows system Timeline Explorer for CSV analysis LNK File Locations Location Description %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Recent\ Recent files accessed %USERPROFILE%\Desktop\ User created shortcuts %USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\ Start Menu shortcuts %USERPROFILE%\AppData\Roaming\Microsoft\Office\Recent\ Office recent documents LNK File Structure Shell Link Header (76 bytes) Offset Size Field 0x00 4 HeaderSize (always 0x0000004C) 0x04 16 LinkCLSID (always 00021401 0000 0000 C000 000000000046) 0x14 4 LinkFlags 0x18 4 FileAttributes 0x1C 8 CreationTime (FILETIME) 0x24 8 AccessTime (FILETIME) 0x2C 8 WriteTime (FILETIME) 0x34 4 FileSize of target 0x38 4 IconIndex 0x3C 4 ShowCommand 0x40 2 HotKey Key Forensic Fields in LNK Files Target file timestamps : Creation, access, modification times of the referenced file Volume information : Serial number, drive type, volume label Network share information : UNC path, share name Machine identifiers : NetBIOS name, MAC address (from TrackerDataBlock) Distributed Link Tracking : Machine ID and object GUID Analysis with EZ Tools LECmd LNK File Parser JLECmd Jump List Parser Jump List Structure Automatic Destinations (automaticDestinations ms) These are OLE Compound files (Structured Storage) identified by AppID hash in the filename: AppID Hash Application 5f7b5f1e01b83767 Windows Explorer Pinned/Frequent 1b4dd67f29cb1962 Windows Explorer Recent 9b9cdc69c1c24e2b Notepad a7bd71699cd38d1c Notepad++ 12dc1ea8e34b5a6 Microsoft Paint 7e4dca80246863e3 Control Panel 1cf97c38a5881255 Microsoft Edge f01b4d95cf55d32a Windows Explorer 9d1f905ce5044aee Microsoft Excel a4a5324453625195 Microsoft Word d00655d2aa12ff6d Microsoft PowerPoint bc03160ee1a59fc1 Outlook Custom Destinations (customDestinations ms) Created when users pin items to application jump lists. These files contain sequential LNK entries. Python Analysis Script Investigation Use Cases Evidence of File Access 1. Parse LNK files from Recent folder to identify accessed documents 2. Cross reference with MFT timestamps and USN Journal entries 3. Note that LNK files persist even after target files are deleted Removable Media Access 1. LNK files referencing drive letters E:, F:, G: indicate removable media usage 2. Volume serial number in LNK identifies the specific device 3. MAC address in TrackerDataBlock identifies the source machine Network Share Activity 1. LNK files with UNC paths (\\server\share) indicate network file access 2. NetBIOS name identifies the remote server 3. Timestamps establish when access occurred Differences Between Windows 10 and Windows 11 Recent research (IEEE 2025) shows that Windows 11 produces different LNK and Jump List artifacts: Fewer automatic LNK files generated for certain file types Modified Jump List behavior for modern applications UWP/MSIX applications may not generate traditional Jump Lists Windows 11 Quick Access replaces some Recent functionality References Shell Link Binary File Format: https://docs.microsoft.com/en us/openspecs/windows protocols/ms shllink/ Magnet Forensics LNK Analysis: https://www.magnetforensics.com/blog/forensic analysis of lnk files/ Jump Lists Forensics 2025: https://www.cybertriage.com/blog/jump list forensics 2025/ Eric Zimmerman's LECmd/JLECmd: https://ericzimmerman.github.io/ Example Output

analyzing-lnk-file-and-jump-list-artifacts