Network details if the file was stored on a network share or remote computer.This will include volume name, serial number, NetBIOS name, and MAC address of the host where the linked file is stored

Information about the volume and system where the LNK file is stored.MAC times of the original file not only will a LNK file contain timestamps for the LNK file itself, it will also contain MAC times for the linked file within its metadata as well.LNK files typically contain the following items of evidentiary value:

The Key Artifacts That Need to be Found When Investigating LNK Files The files might have been wiped or deleted, stored on a USB or network share, so although the file might no longer be there, the LNK files associated with the original file will still exist (and reveal valuable information as to what was executed on the system). LNK files are excellent artifacts for forensic investigators who are trying to find files that may no longer exist on the system they’re examining. Why are LNK Files Important to Your Digital Forensics Investigation? Windows-created LNK files are generated when a user opens a local or remote file or document, giving investigators valuable information on a suspect’s activity. LNK files can be created by the user, or automatically by the Windows operating system. They are shortcut files that link to an application or file commonly found on a user’s desktop, or throughout a system and end with an. LNK files are a relatively simple but valuable artifact for the forensics investigator. This is the third blog post in a series of five about recovering Business Applications & OS Artifacts for your digital forensics investigations.

Win7 find files by date