Recovering Original...
 
Notifications
Clear all

Recovering Original Document from LNK File

theHills90
(@thehills90)
New Member

Hi, 

I am carrying out a Mock forensic case as part of training and we've been given a mock case to work on. I am very interested in retreiving 2 files. They are both .LNK files. I am wondering is there a way of retrieving the original documents from the .LNK files?

 

I have a forensic suite of tools to help me which includes EnCase, Magnet Flavours (IEF, Axiom Process, Axiom Examine)

 

I also have Registry explorer as well as FTK Imager & Autopsy.

 

Thanks

 

This topic was modified 2 years ago by theHills90
Quote
Topic starter Posted : 11/06/2020 1:39 pm
Topic Tags
Mark_Eskridge
(@mark_eskridge)
Member

Link files are simply a reference to the file, but they do not contain the file.

ReplyQuote
Posted : 12/06/2020 2:48 pm
NeriMatrixx
(@nerimatrixx)
Junior Member

You can get the path to the original file but not the actual content. Remember lnk files are shortcut files.

 

The best resource on lnk files https://computerforensics.parsonage.co.uk/downloads/TheMeaningofLIFE.pdf

ReplyQuote
Posted : 15/06/2020 2:32 pm
Share:
Share to...