Take the State of DFIR Survey Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey

Take the State of DFIR Survey

Caseloads, AI, tools and careers. 8 minutes, anonymous, early access to the report.

Take the survey →
Notifications
Clear all

.lnk file search

2 Posts
2 Users
0 Reactions
639 Views
(@forensicnoob)
New Member
Joined: 20 years ago
Posts: 1
Topic starter   [#963]

Good day,

Can someone please provide me with the regular expression search for .lnk files? I'm trying to plug in the expression to search in unallocated space.

Thank you so much.



   
Quote
 Andy
(@andy)
Reputable Member
Joined: 22 years ago
Posts: 357
 

\\x4C\\x00\\x00\\x00\\x01\\x14\\x02

Should do it for you. No footer, but lnk's are small files of 1 or 2 KB.



   
ReplyQuote

Enterprise Partners

  • atola-logo
  • celebrite-logo
  • semantics21 2026 FF logo
  • MagnetForensics_ForensicFocus

Partners

  • detego-logo
  • Logo_MSAB_Black (2)
  • ADF
  • gmdsoft-logo
  • logo Belkasoft 135x100
  • Aid4Mail-Logo

Academic Partners

  • University of Southampton logo 2
Share: