File and folder accesswindowsPro
LNK files and Jump Lists
Windows writes a shortcut when a file is opened, capturing the target's path, size and timestamps at that moment. The shortcut routinely outlives the file, and preserves metadata about a document you no longer have.
What members see here
- Every path this artifact lives at, and which builds each applies to.
- What it proves, and what it does not prove, which is the part that matters.
- How to parse it, and the tooling that reads it correctly.
- Hunting queries for Splunk, Sentinel and Elastic, with their false-positive notes.