Most computer users will know that certain locations on your computer can store information about what you have done. Web browser history is one area that everyone knows can store computer and personal data. In Windows there are other less well known places that can record information you wouldn’t necessarily expect. Some are used when looking for forensic data and determining the history of certain files. One of those areas is the humble Windows .LNK shortcut file.
On the face of it a simple shortcut is a tiny file that points to another file, such as an executable to launch a program from your desktop. Some details about the shortcut can be obtained by right clicking on it and clicking Properties. The Shortcut tab shows things like where the target file is located while the Details tab will show the date when the shortcut was created. But there’s much more to a standard shortcut than you might think.

Actually, all .LNK shortcut files contain large amounts of data that identify the computer on which they were created as well as the computer they are currently on. For instance, inside the file data the network adapter MAC address and name of the original computer is stored along with any used network paths. Even the label, type and serial number of the drive it was created on is viewable. There is also much more data relating to times and dates to be found.
If you want to look at what data is being stored inside your shortcuts you will need a third party tool to decode that information as something like a hex editor will just show mostly gibberish. Here are 5 free tools for you to try out.
(more…)





