.lnk files and crea...
 
Notifications
Clear all

.lnk files and create dates

5 Posts
4 Users
0 Reactions
1,282 Views
(@research1)
Estimable Member
Joined: 17 years ago
Posts: 165
Topic starter  

Quick question, what scenarios alter the create date time stamp of a .lnk file, of a Microsoft document? I have done tests for these answers I just want clarification from some other people.

Accessing a Microsoft document for the first time creates a .lnk file, with the create date corresponding to that first access of the Microsoft Document. Other than that, the create date time stamp of a link file does not alter?

Another question, of course last access stamp of a .lnk tells you when the actual office document was accessed first, but, is that updated on initial access, or on closure of that document?

Regards


   
Quote
(@rich2005)
Honorable Member
Joined: 19 years ago
Posts: 541
 

Last accessed stamp will change on the document close (just checked).
As for the creation, i dont think that should change (off the top of my head), obviously getting rid of the contents of the recent folder, and opening again would mean a new shortcut and so new creation time, or if you copied the shortcut etc.
If thats any help,
Rich


   
ReplyQuote
PaulSanderson
(@paulsanderson)
Honorable Member
Joined: 19 years ago
Posts: 651
 

The change of last accessed time stamp on a link file depends on where the link file is - the purpose of a link file in the recent docs folder is very different than say one in the send to folder.

Harry Parsonage has done some good work on link files and when they are updated.


   
ReplyQuote
(@research1)
Estimable Member
Joined: 17 years ago
Posts: 165
Topic starter  

Thanks for you replies. Sandy, can you provide me with a link to this work?


   
ReplyQuote
ecophobia
(@ecophobia)
Estimable Member
Joined: 17 years ago
Posts: 127
 

I think this is the link mentioned by Paul and I must agree, Harry Parsonage has done a good work.

http//computerforensics.parsonage.co.uk/downloads/TheMeaningofLIFE.pdf


   
ReplyQuote
Share: