Sanderson Forensics has announced the release of LinkAlyzer. LinkAlyzer is a forensic tool that decodes and displays the content of multiple link files (Windows Shortcuts) at the same time. LinkAlyzer Loads multiple (tested on 40,000+) link files into a grid and displays all of the normal Link file contents, dates and times, vol serial numbers and names, relative paths, sharenames, working directories etc…You can use LinkAlyzer to:
• which link files point to a specific bit of media
• which folders have been shared
• the serial numbers of disks that have been attached to the computer
But as it also displays and decodes Object ID’s for those Link Files
that have them (on NTFS volumes this is most), you can also determine:
• dates and times when a computer was booted
• that a file has been moved from a different computer (and determine
the MAC address)
• that a file has been moved between volumes on the same computer
You may in some circumstances also be able to determine whether the
system clock has been wound back.
You can of course tag relevant files and produce a report of your findings
More information here www.sandersonforensics.com/LinkAlyzer.html
