RE: Lnk files

These may help:

http://www.forensicfocus.com/link-file-evidentiary-value

http://windowsir.blogspot.com/2007/12/windows-shortcut-lnk-files.html

What are you using to look at the MAC times?

If I right click and check the properties of a file, I will change the date
accessed property.

-----Original Message-----
From: listbounce@xxxxxxxxxxxxxxxxx [mailto:listbounce@xxxxxxxxxxxxxxxxx]
On Behalf Of Alex Fiuvertiz
Sent: Friday, February 06, 2009 11:15 PM
To: security-basics@xxxxxxxxxxxxxxxxx
Subject: Lnk files

Hi,

On windows you have a "recent" folder (example C:\Documents
and...\user\recent) which contains .lnk files.
What operation on windows can cause the property "Date Accessed" on
multiple files in this directory to change timestamp, but the "Date
Modified" and "Date Created" are not altered?

When using roaming profiles the "Date Created" is also changed so that
is not the case. A search doesn't either generate this phenomenon. And
not AV scans.

Appreciate your thoughts and ideas.

/ Alex

Relevant Pages

  • Re: Lnk files
    ... We´re using EnCase. ... On Behalf Of Alex Fiuvertiz ... Subject: Lnk files ... What operation on windows can cause the property "Date Accessed" on ...
    (Security-Basics)
  • Re: PROBE-FILE and Windows shortcuts
    ... That would make it possible to use ASDF on Windows as it was ... by creating shortcuts to .asd files in ... Windows shortcut .lnk files are more closely analogous to ... clisp is likely just using that support, ...
    (comp.lang.lisp)
  • Re: OT Re: How to create windows shortcut/.lnk files from linux?
    ... > I don't have access to a windows box, and so I can't do as you suggest. ... > I also used putty as an example. ... characters in the target string seem to be seporated by some sort of ... and that M$ doesn't use any kind of checksum in their LNK files. ...
    (comp.os.linux.misc)
  • Re: [SLE] DVD filenames are not correct under Windows...
    ... I tried to write a DVD with both RockRidge ... Windows shortcut files are ... If you have .lnk files among the files you're writing to the CD, ... were on Windows file system volumes that I have mounted under Linux. ...
    (SuSE)
  • Re: all exe files switched to .lnk file type??
    ... to start Windows at all. ... Shortcuts actually have the extension .lnk - but this is usually hidden by ... It could be that the associations for .lnk files have been messed up. ... Search on Google for "lnk association". ...
    (microsoft.public.windowsxp.help_and_support)