Type Windows Link

<< Details >>

Defined Constant	Type_Windows_Link
File Type Value	396
Parent Type	None
Carve	Yes
Format Details	Yes
Carve Meta Data	Yes
MIME Type	application/octet-stream
Filename Extension	lnk

Link

Description

Windows Shortcut

Truxton Exploiters

This file type is handled by the following ETLs:

• Expand

Items Produced

Truxton will extract the following from this file type:

• ENTITY_TYPE_MAC_ADDRESS
• ENTITY_TYPE_MACHINE_NAME
• ENTITY_TYPE_VOLUME_NAME
• ENTITY_TYPE_VOLUME_SERIAL_NUMBER
• URL_TYPE_BOOKMARK
• Type_File_Details

Carve Meta Data

When Truxton carves this file, it can populate the following columns in the [File] table:

• Attributes - The attributes file was created
• Created - When the file was created
• LastAccess - When the file was last modified
• LastWrite - When the file was last modified
• Name - The name of the file

Details

• Link
• Kaitai