Link Files.lnk Jesse Hager “The Windows Shortcut File Format” ws_Shortcut_File_Format.pdf&can=2&q=

Shortcut Files File extension.lnk Created whenever an off board file is opened Contain MAC times (UTC) Path name Volume type and S/N

Link File Creation Activation of a file from Windows Explorer When a file is opened from some applications Particularly Microsoft Office files

Clear “Recent Items” WinXP Properties of the Start Menu Select “Clear List”

.lnk Files They appear as “My Recent Documents” Form the basis of Jump Lists Win XP C:\Documents and Settings\User Name\Recent Vista & Win7 \Users\user name\AppData\Roaming\Microsoft\Windows\Recent \Users\user name\AppData\Roaming\Microsoft\Office\Recent \Users\user name\Links\

Clear “Recent Items” Win 7 To clear “Recent Item List” Right click on Recent Items and select clear

Registry Data Shows Settings WinXP Start_ShowRecentDocs=0 Do not list Recent Documents Start_ShowRecentDocs=2 List Recent Documents

Registry Data Shows Settings Win7 Start_ShowRecentDocs=0 & Start_Tracks=0 Do not list Recent Documents Start_ShowRecentDocs=2 & Start_Tracks=0 List Recent Documents

Basic File Structure File header Shell item ID list Item 1 Item 2 etc. File location info local path Network path Description string Relative path string Working directory string Command line string Icon filename string Extra stuff

.lnk Header Structure OffsetSizeTypeDescription 04 bytes1 dwordMagic Number 0x C = ‘L’ 416 bytesbyteGUID for shortcut files 0x144 bytes1 dwordFlags 0x184 bytes1 dwordFile Attributes 0x1C8 bytes1 qwordCreate time 0x248 bytes1 qwordLast write time 0x2C8 bytes1 qwordLast access time 0x344 bytes1 dwordFile length 0x384 bytes1 dwordIcon number 0x3C4 bytes1 dwordShow Window value 0x404 bytes1 dwordAssociated Hot Key 0x448 bytes2 dwordUnknown, always zero

The Flags BitMeaning when 1Meaning when 0 0Shell item id list is presentShell item id list is absent 1Points to a file or directoryPoints to something else 2Has a descriptive stringNo descriptive string 3Has a relative pathNo relative path 4Has a working directoryNo working directory 5Has command line argumentsNo command line arguments 6Has a custom iconHas default icon

Shell Item ID List Present only if bit 0 is set in flags How to get from the desktop to the contents of the link file

File Location Info OffsetSizeContents 0x04 bytesTotal length of this structure 0x4“Point to the first offset after this structure. 0x1C 0x8“Flags 0xC“Offset of local volume info 0x10“Offset of base pathname on local system 0x14“Offset of network volume info 0x18“Offset of remaining pathname

lslnk.exe

.lnk File’s Properties

Cierra’s pics 2.nws.lnk Magic Number File Length 0x43A00 =

Lslnk.exe for Win7

Win7 LNK file Properties

More Information in Win7