1. Link Files.lnk Jesse Hager “The Windows Shortcut File Format” http://code.google.com/p/8bits/downloads/detail?name=The_Windo ws_Shortcut_File_Format.pdf&can=2&q=

2. Shortcut Files File extension.lnk Created whenever an off board file is opened Contain MAC times (UTC) Path name Volume type and S/N

3. Link File Creation Activation of a file from Windows Explorer When a file is opened from some applications Particularly Microsoft Office files

4. Clear “Recent Items” WinXP Properties of the Start Menu Select “Clear List”

5. .lnk Files They appear as “My Recent Documents” Form the basis of Jump Lists Win XP C:\Documents and Settings\User Name\Recent Vista & Win7 \Users\user name\AppData\Roaming\Microsoft\Windows\Recent \Users\user name\AppData\Roaming\Microsoft\Office\Recent \Users\user name\Links\

6. Clear “Recent Items” Win 7 To clear “Recent Item List” Right click on Recent Items and select clear

7. Registry Data Shows Settings WinXP Start_ShowRecentDocs=0 Do not list Recent Documents Start_ShowRecentDocs=2 List Recent Documents

8. Registry Data Shows Settings Win7 Start_ShowRecentDocs=0 & Start_Tracks=0 Do not list Recent Documents Start_ShowRecentDocs=2 & Start_Tracks=0 List Recent Documents

9. Basic File Structure File header Shell item ID list Item 1 Item 2 etc. File location info local path Network path Description string Relative path string Working directory string Command line string Icon filename string Extra stuff

10. .lnk Header Structure OffsetSizeTypeDescription 04 bytes1 dwordMagic Number 0x0000004C = ‘L’ 416 bytesbyteGUID for shortcut files 0x144 bytes1 dwordFlags 0x184 bytes1 dwordFile Attributes 0x1C8 bytes1 qwordCreate time 0x248 bytes1 qwordLast write time 0x2C8 bytes1 qwordLast access time 0x344 bytes1 dwordFile length 0x384 bytes1 dwordIcon number 0x3C4 bytes1 dwordShow Window value 0x404 bytes1 dwordAssociated Hot Key 0x448 bytes2 dwordUnknown, always zero

11. The Flags BitMeaning when 1Meaning when 0 0Shell item id list is presentShell item id list is absent 1Points to a file or directoryPoints to something else 2Has a descriptive stringNo descriptive string 3Has a relative pathNo relative path 4Has a working directoryNo working directory 5Has command line argumentsNo command line arguments 6Has a custom iconHas default icon

12. Shell Item ID List Present only if bit 0 is set in flags How to get from the desktop to the contents of the link file

13. File Location Info OffsetSizeContents 0x04 bytesTotal length of this structure 0x4“Point to the first offset after this structure. 0x1C 0x8“Flags 0xC“Offset of local volume info 0x10“Offset of base pathname on local system 0x14“Offset of network volume info 0x18“Offset of remaining pathname

14. lslnk.exe

15. .lnk File’s Properties

16. Cierra’s pics 2.nws.lnk Magic Number File Length 0x43A00 = 276992

17. Lslnk.exe for Win7

18. Win7 LNK file Properties

19. More Information in Win7