Lion Cipher Lab

Reconstruct which files a user opened — and the machine and drive they came from — with Windows LNK files

• Digital Forensics & IR (DFIR)
• Intermediate
• ~50 min
• Free · no account required

Why it matters

Over and over a case turns on one question about one file: 'did this account open this document?', 'where did the file come from — this machine, or a USB, or a share?', 'was it opened on THIS computer or carried in from another?'. Windows answers the first for free, as a side effect of a convenience feature almost nobody thinks about: every time you open a file through a normal shell path (double-click it, use File > Open, click it in a recent list), Windows quietly writes a small SHORTCUT — a .lnk file — into %APPDATA%\Microsoft\Windows\Recent\ so it can offer that file back to you as…

What you'll learn

• explaining in plain words what a LNK (shell link / .lnk shortcut) file is, and that Windows AUTO-CREATES one per file you open under %APPDATA%\Microsoft\Windows\Recent\ — separate from any shortcut you make by hand
• reading the LINK-TARGET metadata a LNK is richest in: the target's full path, the TARGET file's own MAC (Modified/Accessed/Created) timestamps, and the target size captured at open time
• defining and finding the source-volume fields — the VOLUME SERIAL NUMBER (the id Windows stamps on a drive, e.g. A1B2-C3D4) and the VOLUME LABEL — and reading the DRIVE TYPE (fixed / removable / network) that says what KIND of drive the file lived on
• defining the machine-identity fields baked into every LNK — the NetBIOS (computer) name and the MAC address of the machine that CREATED the shortcut (the distributed-link-tracking 'birth' identifiers) — and what they let you prove when a LNK travels
• installing and running Eric Zimmerman's LECmd (LNK Explorer Command line) — parsing a whole folder with -d, a single file with -f, writing --csv — and reading the output in Timeline Explorer
• manufacturing ground truth: creating a distinctively named test file, opening it so Windows writes a \Recent\ .lnk, and checking LECmd's recovered target path / serial / machine name against your own notes
• proving the headline property: delete the target file, empty the Recycle Bin, re-parse, and show the .lnk STILL resolves the deleted file's path and metadata — file-access evidence that OUTLIVES the file
• drawing the line against the jump-lists lab (one file per APP vs one .lnk per FILE) and against shellbags (folder browsed) and Prefetch (execution), and stating the honest limits of a \Recent\ LNK out loud

Steps in this lab

1. From zero: what a LNK file is, and why Windows makes one every time you open a file
2. How this differs from the jump-lists lab (read this so the two never blur)
3. Locate the \Recent\ LNK files on your own machine
4. Manufacture ground truth: create a distinctive file and OPEN it
5. Get LECmd and parse the \Recent\ folder to CSV
6. Read the LNK: target path, target MAC times, volume serial, drive type, machine name
7. The headline: delete the file, empty the bin, re-parse, and watch the LNK survive
8. The honest negative: what a \Recent\ LNK does NOT prove
9. Judgment: where \Recent\ LNK files fit, and when you reach for them

Open the full interactive lab →