LinkAlyzer released

Sanderson Forensics has announced the release of LinkAlyzer. LinkAlyzer is a forensic tool that decodes and displays the content of multiple link files (Windows Shortcuts) at the same time. LinkAlyzer Loads multiple (tested on 40,000+) link files into a grid and displays all of the normal Link file contents, dates and times, vol serial numbers and names, relative paths, sharenames, working directories etc…You can use LinkAlyzer to:

• which link files point to a specific bit of media
• which folders have been shared
• the serial numbers of disks that have been attached to the computer

But as it also displays and decodes Object ID’s for those Link Files
that have them (on NTFS volumes this is most), you can also determine:

• dates and times when a computer was booted
• that a file has been moved from a different computer (and determine
the MAC address)
• that a file has been moved between volumes on the same computer

You may in some circumstances also be able to determine whether the
system clock has been wound back.

Get The Latest DFIR News

Join the Forensic Focus newsletter for the best DFIR articles in your inbox every month.

Unsubscribe any time. We respect your privacy - read our privacy policy.

You can of course tag relevant files and produce a report of your findings

More information here

Leave a Comment

Latest Videos

This error message is only visible to WordPress admins

Important: No API Key Entered.

Many features are not available without adding an API Key. Please go to the YouTube Feeds settings page to add an API key after following these instructions.

Latest Articles