What is the best way to determine if a LNK file was user created or Windows created?
Thanks,
Andy
I suppose for me it would be the context surrounding the LNK file. What is its current location on the HDD?
I would examine the LNK and establish what it is a shortcut to. If it's a user file, such as a word document or spreadsheet etc, then the LNK goes to support that it's a user established LNK.
If it relates to an application, then a quick 'test' installation would show if a shortcut is created by default.
The above advice is good.
Have a look at http//
Use a tool to extract the embedded data.
Experimentation is a good idea - for example Can you get Windows to create a similar file in that location in another machine? Are the differences explainable (different dates for example)?
I could go on for ages but if you approach the problem in a scientific manner then it will help.
I have written a command-line (cmd or Powershell) tool to extract embedded data available at
https://
Other tools are available 😉