01Location
- C:\Users\<user>\AppData\Roaming\Microsoft\Windows\Recent\*.lnk
- C:\Users\<user>\AppData\Roaming\Microsoft\Office\Recent\*
- Numbered streams inside *.automaticDestinations-ms Jump List files
- Any *.lnk file (desktop, Start menu, removable media)
02Questions it answers
- Which file or folder did the link point to, on which volume or network share?
- Was the target on removable media (drive type, serial number, volume label)?
- What were the target's timestamps and size as recorded in the link?
- On which machine (machine identifier, droid identifiers) did the target reside?
- Which command-line arguments and working directory does a shortcut pass to its target?
03Format and versions
| Format | [MS-SHLLINK] Shell Link Binary File Format: 76-byte ShellLinkHeader (class identifier 00021401-0000-0000-C000-000000000046), optional LinkTargetIDList (shell items), LinkInfo (volume or network location), StringData and ExtraData blocks. Little-endian; FILETIME in UTC; strings in UTF-16LE or a codepage. |
|---|---|
| Applies to | Windows 95 to Windows 11; Microsoft maintains the specification (revision 10.0, 2025) and liblnk has been tested up to Windows 10. |
04Key fields
| Field | What it tells you |
|---|---|
| ShellLinkHeader times | CreationTime, AccessTime and WriteTime of the link target in UTC; 0 means not set. |
| FileSize | Size of the link target; for targets larger than 0xFFFFFFFF only the least significant 32 bits. |
| Volume information | Drive type, drive serial number and volume label (ASCII and/or UTF-16). |
| Local path / network share / common path | Components from which the full target path is rebuilt. |
| Data strings | Description, relative path, working directory, command-line arguments, icon location. |
| Distributed link tracker block | Machine identifier string, droid volume/file identifiers and birth droid identifiers (NTFS object IDs). |
05Timestamps
| Field | Encoding | Note |
|---|---|---|
| CreationTime / AccessTime / WriteTime | FILETIME (UTC) | Describe the link target as recorded in the file, not the moment the .lnk was opened. |
| Shell item times in LinkTargetIDList | FAT date/time (UTC) | Per-component times from the embedded shell items. |
Decode raw values with the Timestamp decoder and convert local wall-clock times with the Local time to UTC.
06Examination workflow
- Collect LNK files from Recent, Office Recent, desktops, Start menu folders and Jump List streams.
- Parse the header, IDList, LinkInfo, string data and extra data blocks.
- Compare target times in the header with the .lnk file's own file system times.
- Use drive type, serial number and tracker identifiers to tie targets to volumes and hosts, then correlate with USB history and ShellBags.
07Interpretation pitfalls
- Most structures are optional and controlled by data flags; ForceNoLinkTrack means no tracker block is present.
- FileSize is truncated for targets larger than 4 GiB.
- Some strings may contain unpaired UTF-16 surrogates; use parsers that tolerate them.
09Sources
- [MS-SHLLINK]: Shell Link (.LNK) Binary File Format Microsoft Open Specifications · checked 2026-10-14
- [MS-SHLLINK] 2.1 ShellLinkHeader Microsoft Open Specifications · checked 2026-10-14
- Windows Shortcut File (LNK) format libyal / liblnk (J. Metz) · checked 2026-10-14
- Jump lists format libyal / dtformats (J. Metz) · checked 2026-10-14
- Windows artifact definitions (windows.yaml) ForensicArtifacts / artifacts · checked 2026-10-14