Use Windows File Analyzer to analyze lnk files

Hi,

When it comes to lnk file analysis, we should put more emphasis on the volume serial number. It could help forensic guys to identify whether interest files exist(ed) on certain volume or not. That means volume serial number could associate file existence on certain volume. Let's take a look at my blog as below
http//www.cnblogs.com/pieces0310/p/4705065.html

Now you know that if the volume being formated and the volume serial number will change. Don't forget the effect of formatting to volume serial number. Take it into consideration whenever you analyze volume serial number association with another clues.