IHU Cybersecurity Exam Notes

Source: Juni_2026_Exams/Advance_Forensics/notes/05-lnk-recentdocs-userassist.md

🔗 LNK Files & Recent Documents Guide

What are LNK Files?

.lnk files are Windows shortcuts. But in forensics, they're gold — they record:

🎯 Where LNK Files Come From

Windows Recent Files System

Every time a user opens a file, Windows automatically creates a .lnk shortcut in:

C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Recent\

This is automatic — the user doesn't create these manually.

Number: Usually 10-100+ recent shortcuts depending on activity

📍 LNK File Locations

Recent Documents Folder

Standard location:
C:\Users\[Username]\AppData\Roaming\Microsoft\Windows\Recent\

Contains:
├── document1.lnk → Shortcuts to recently opened files
├── document2.lnk
├── spreadsheet.lnk
└── malware.lnk ← Could reveal suspicious activity

Recycle Bin

C:\$Recycle.Bin\[SID]\

Contains:
├── $IIII1234.lnk → Deleted shortcuts
└── ...

AutoStart/Temp Locations

Suspicious:
├── C:\Users\[Username]\Startup\*.lnk
├── C:\Temp\*.lnk
├── C:\Windows\Temp\*.lnk
└── C:\Programm Files\...\*.lnk

📖 LNK File Anatomy

What Each LNK Contains

Display Name:        File name shown in Recent
Target Path:         Original file's full path
Arguments:           Parameters passed to program
Working Directory:   Where program runs from
Icon Location:       Where icon comes from
File Size:           Size of target file (bytes)
Access Time:         When shortcut was accessed
Attribute Flags:     Archive, read-only, hidden, etc.
Timestamps:          File modification time

🛠️ How to Analyze LNK Files

Method 1: LNK Parser Tools

Available Tools:

Method 2: Using LECmd

LECmd.exe -f C:\Users\John\AppData\Roaming\Microsoft\Windows\Recent\document.lnk --csv C:\Output\

Result outputs:
┌─────────────────────────────┐
│ Display Name: report.docx   │
│ Target: C:\Users\John\Docs  │
│ Accessed: 2021-08-10 14:30  │
└─────────────────────────────┘

Method 3: Windows Properties

Right-click .lnk file:
Properties → Shortcut tab

Shows:
├── Target: [original file path]
├── Start in: [working directory]
└── Modified date: [when shortcut was created]

📊 LNK Information Extraction

Key Information to Extract

For each .lnk file, document:

Shortcut Name:      [display name]
Original Path:      [full path to original file]
Target Device:      [local drive or network]
Original Size:      [bytes]
Date Created:       [file creation timestamp]
Date Modified:      [last modification]
Date Accessed:      [via shortcut access]
Program Used:       [what opened the file]
Arguments:          [parameters passed]
Working Directory:  [where program runs from]

🔍 Forensic Exam Use Cases

Case 1: Timeline of File Access

Question: "When was the file 'financial_data.xlsx' accessed?"

Steps:
1. Find Recent folder
2. Search for: financial_data.xlsx (or .lnk version)
3. Note: Access time in shortcut properties
4. Answer: [Date] [Time] UTC

Case 2: Recover Original File Path

Question: "What is the full path of the deleted file?"

Steps:
1. Find .lnk file for deleted file
2. Open with LECmd or properties
3. Read: Target field
4. Answer: C:\Users\John\AppData\Local\Temp\malware.exe

Case 3: Identify Program Usage

Question: "What programs did the user run?"

Steps:
1. Scan all .lnk files in Recent
2. Extract "Program Used" field
3. List all programs and dates
4. Answer: Chronological list of programs

Case 4: Suspicious File Access

Question: "Did the user access any suspicious files?"

Steps:
1. List all .lnk files
2. Look for: 
   ├── Temp folder files
   ├── Executable files (.exe)
   ├── Downloaded files
   └── Malware names
3. Answer: Found [suspicious_file] in [location]

🔗 Connection to RecentDocs Registry

USER OPENS FILE
    ↓
Windows creates .lnk in Recent folder
Windows updates NTUSER.DAT\RecentDocs
    ↓
Both artifacts show file access

Registry entry: NTUSER.DAT\RecentDocs
Shortcut file: C:\Users\[user]\AppData\Roaming\Microsoft\Windows\Recent\

Using Both Together

Question: "Prove the user accessed this sensitive file"

Evidence:
1. .lnk file in Recent folder ✓ (timestamp)
2. Registry RecentDocs entry ✓ (backup confirmation)
3. Both point to: C:\Finance\secret_data.xlsx
4. Timestamp: 2021-08-10 14:30 UTC

Answer: Double evidence of file access

⚠️ Interpreting LNK Timestamps

What Timestamps Mean

LNK File Modified Date:
└─ When the shortcut was CREATED (file accessed)
   (Not when the original file was created)

Example:
├── original_file.txt created: 2021-08-01
├── original_file.txt modified: 2021-08-05
└── original_file.lnk created: 2021-08-10 ← User accessed it today

Timeline Interpretation

If you see:
├── LNK created: 2021-08-10 14:30
├── Original file modified: 2021-08-05
└── LNK accessed date: 2021-08-10 14:30

Interpretation: User opened old file today at 14:30

📋 LNK File Analysis Checklist

For each suspicious .lnk file:

🎯 Common LNK Patterns in Exams

Pattern 1: Malware Execution

LNK found: malware.exe
Original path: C:\Windows\Temp\malware.exe
Accessed: 2021-08-10 14:30
Pattern: .exe in Temp folder = suspicious

Pattern 2: Data Exfiltration

LNK found: secret_data.xlsx
Original path: C:\Finance\confidential.xlsx
Accessed: 2021-08-09 (when breach occurred)
Pattern: Sensitive file accessed at suspicious time

Pattern 3: Script Execution

LNK found: script.ps1
Original path: C:\Users\John\AppData\Local\Temp\install.ps1
Accessed: 2021-08-08 09:15
Argument: -NoProfile -ExecutionPolicy Bypass
Pattern: PowerShell script with admin bypass

🔍 How to Extract LNK Files

Using FTK Imager

1. Open forensic image
2. Navigate to:
   C:\Users\[username]\AppData\Roaming\Microsoft\Windows\Recent
3. Select all .lnk files (Ctrl+A)
4. Right-click → Export
5. Save to: D:\Evidence\LNK\

Command-Line Extraction

Copy C:\Users\*\AppData\Roaming\Microsoft\Windows\Recent\*.lnk D:\Evidence\LNK\

🛠️ Practical Workflow

Step 1: Extract LNK Files

Use FTK Imager to export all .lnk files
Destination: D:\Evidence\LNK\

Step 2: Analyze with LECmd

LECmd.exe -d D:\Evidence\LNK\ --csv D:\Output\

Generates CSV with all LNK data

Step 3: Review CSV Results

Open D:\Output\LECmd_summary.csv
Review:
├── Display Name
├── Target Path
├── File Size
├── Modified Date
└── Notes

Step 4: Identify Suspicious

Look for:
├── Temp folder files
├── Hidden directories
├── Executable files
├── Recent access to sensitive data
└── Unusual programs

Step 5: Document Findings

Create evidence list:
├── File 1: malware.exe @ C:\Temp (2021-08-10 14:30)
├── File 2: secret.xlsx @ C:\Finance (2021-08-10 14:35)
└── ...

💡 Pro Tips

Tip 1: Sort by Access Date

Most recently accessed .lnk files = Most recent user activity
Look at last 10-20 files first

Tip 2: Look for Inconsistencies

Modified date ≠ Shortcut date = File changed after access
Old file with new shortcut = Recent re-access of old file

Tip 3: Check for Auto-Run LNK Files

C:\Users\[user]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
.lnk files here = Auto-run programs
This is persistence mechanism

🎓 Quick Reference

LNK File Locations

Normal:     C:\Users\[user]\AppData\Roaming\Microsoft\Windows\Recent\
Startup:    C:\Users\[user]\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Deleted:    C:\$Recycle.Bin\[SID]\
Suspicious: C:\Temp\, C:\Windows\Temp\, anywhere unusual

Tools

LECmd         - Best: Command-line, accurate extraction
WinEventLog   - Recent files via Event Log
Registry      - RecentDocs for backup confirmation
Properties   - Quick check in Windows GUI

What to Memorize

.lnk = Shortcut file created when user accesses file
Created date of .lnk = Timestamp of access
Target = Original file path
RecentDocs = Registry backup of recent files

📝 Exam Answer Template

Question: "Identify all recently accessed files"

Tool: LNK Parser (LECmd) + FTK Imager

Steps:
1. Exported all .lnk files from:
   C:\Users\[username]\AppData\Roaming\Microsoft\Windows\Recent\
2. Parsed with LECmd
3. Reviewed CSV output
4. Identified suspicious files

Findings:
┌─────────────────────────────────────┐
│ File: malware.exe                   │
│ Path: C:\Windows\Temp\malware.exe   │
│ Accessed: 2021-08-10 14:30 UTC     │
│ Assessment: SUSPICIOUS (Temp+.exe)  │
└─────────────────────────────────────┘

Answer: Found [X] recently accessed files, [Y] suspicious

Last Updated: June 15, 2026