API Reference: LNK File and Jump List Forensics
LECmd (Eric Zimmerman) - LNK Parser
Syntax
LECmd.exe -f <file.lnk> # Single file
LECmd.exe -d <directory> --all # All files in directory
LECmd.exe -d <dir> --csv <output_dir> # CSV export
LECmd.exe -d <dir> --json <output_dir> # JSON export
LECmd.exe -f <file.lnk> -q # Quiet mode
LECmd.exe -d <dir> -r # Only removable drives
Output Fields
| Field |
Description |
| SourceFile |
Path to the .lnk file |
| TargetCreated |
Target file creation timestamp |
| TargetModified |
Target file modification timestamp |
| TargetAccessed |
Target file access timestamp |
| FileSize |
Target file size |
| RelativePath |
Relative path to target |
| WorkingDirectory |
Working directory for target |
| Arguments |
Command-line arguments |
| LocalPath |
Full local path to target |
| VolumeSerialNumber |
Volume serial of target drive |
| DriveType |
Fixed, Removable, Network |
| MachineID |
NetBIOS name from tracker block |
| MacAddress |
MAC from distributed tracker |
JLECmd (Eric Zimmerman) - Jump List Parser
Syntax
JLECmd.exe -f <jumplist_file> # Single file
JLECmd.exe -d <directory> # All jump lists
JLECmd.exe -d <dir> --csv <output> # CSV export
JLECmd.exe -d <dir> --fd # Full LNK details
JLECmd.exe -d <dir> --dumpTo <dir> # Extract embedded LNK files
Jump List Locations
%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\
%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\
LnkParse3 (Python)
Installation
pip install LnkParse3
Usage
import LnkParse3
with open("shortcut.lnk", "rb") as f:
lnk = LnkParse3.lnk_file(f)
info = lnk.get_json()
print(info["data"]["relative_path"])
print(info["header"]["creation_time"])
print(info["link_info"]["local_base_path"])
# Extra data blocks
extra = info.get("extra", {})
tracker = extra.get("DISTRIBUTED_LINK_TRACKER_BLOCK", {})
print(tracker.get("machine_id"))
print(tracker.get("mac_address"))
Shell Link Binary Format (MS-SHLLINK)
| Offset |
Size |
Field |
| 0 |
4 |
HeaderSize (0x0000004C) |
| 4 |
16 |
LinkCLSID |
| 20 |
4 |
LinkFlags |
| 24 |
4 |
FileAttributes |
| 28 |
8 |
CreationTime (FILETIME) |
| 36 |
8 |
AccessTime (FILETIME) |
| 44 |
8 |
WriteTime (FILETIME) |
| 52 |
4 |
FileSize |
| 56 |
4 |
IconIndex |
| 60 |
4 |
ShowCommand |
Common App IDs (Jump Lists)
| App ID |
Application |
| 1b4dd67f29cb1962 |
Windows Explorer |
| 5d696d521de238c3 |
Google Chrome |
| ecd21b58c2f65a4f |
Firefox |
| 1bc392b8e104a00e |
Remote Desktop (mstsc) |
| b8ab77100df80ab2 |
Microsoft Word |
| cfb56c56fa0f0478 |
PuTTY |
| b74736c2bd8cc8a5 |
WinSCP |
Suspicious LNK Indicators
| Pattern |
Concern |
| PowerShell in arguments |
Script execution via shortcut |
| cmd.exe /c in target |
Command execution chain |
| UNC path to IP |
Network-based payload delivery |
| Base64 encoded arguments |
Obfuscated commands |
| mshta/wscript target |
Living-off-the-land execution |
24f816b6a3