Notifications
Clear all
General (Technical, Procedural, Software, Hardware etc.)
3
Posts
3
Users
0
Reactions
4,248
Views
Topic starter
11/06/2020 1:39 pm
Hi,
I am carrying out a Mock forensic case as part of training and we've been given a mock case to work on. I am very interested in retreiving 2 files. They are both .LNK files. I am wondering is there a way of retrieving the original documents from the .LNK files?
I have a forensic suite of tools to help me which includes EnCase, Magnet Flavours (IEF, Axiom Process, Axiom Examine)
I also have Registry explorer as well as FTK Imager & Autopsy.
Thanks
12/06/2020 2:48 pm
Link files are simply a reference to the file, but they do not contain the file.
15/06/2020 2:32 pm
You can get the path to the original file but not the actual content. Remember lnk files are shortcut files.
The best resource on lnk files https://computerforensics.parsonage.co.uk/downloads/TheMeaningofLIFE.pdf