In this article, the Belkasoft Team explains what LNK files are and why they are important, where one can find them, and how to analyze them with Belkasoft Evidence Center.LNK files (labels or Windows shortcut files) are typically files which are created by the Windows OS automatically, whenever a user opens their files. These files are used by the operating system to secure quick access to a certain file. In addition, some of these files can be created by users themselves to make their activities easier.
Location
Normally, most of LNK-files are located on the following paths:
– For Windows 7 to 10: C:\Users\%USERNAME%\AppData\Roaming\Microsoft\Windows\Recent
– For Windows XP: C:\Documents and Settings\%USERNAME%\Recent
However, there many other places where investigators can find LNK files:
