Forums
Main Category
General (Technical,...
Recovering Original...
 
Notifications
Clear all

Recovering Original Document from LNK File

 
General (Technical, Procedural, Software, Hardware etc.)
Last Post by NeriMatrixx 5 years ago
3 Posts
3 Users
0 Reactions
2,885 Views
RSS
 theHills90
(@thehills90)
New Member
Joined: 5 years ago
Posts: 1
Topic starter 11/06/2020 1:39 pm  

Hi, 

I am carrying out a Mock forensic case as part of training and we've been given a mock case to work on. I am very interested in retreiving 2 files. They are both .LNK files. I am wondering is there a way of retrieving the original documents from the .LNK files?

 

I have a forensic suite of tools to help me which includes EnCase, Magnet Flavours (IEF, Axiom Process, Axiom Examine)

 

I also have Registry explorer as well as FTK Imager & Autopsy.

 

Thanks

 

This topic was modified 5 years ago by theHills90

   
Quote
Topic Tags
LNK docx
Mark_Eskridge
 Mark_Eskridge
(@mark_eskridge)
Trusted Member
Joined: 16 years ago
Posts: 50
12/06/2020 2:48 pm  

Link files are simply a reference to the file, but they do not contain the file.


   
ReplyQuote
 NeriMatrixx
(@nerimatrixx)
Eminent Member
Joined: 6 years ago
Posts: 26
15/06/2020 2:32 pm  

You can get the path to the original file but not the actual content. Remember lnk files are shortcut files.

 

The best resource on lnk files https://computerforensics.parsonage.co.uk/downloads/TheMeaningofLIFE.pdf


   
ReplyQuote
Forum Jump:
  Previous Topic
Next Topic  
Topic Tags:  LNK (1) , docx (1) ,
Share: