LNK Files and Jump Lists
LNK shortcut files and Jump Lists are Windows user-activity artifacts that record which files were opened, when, and from where — including files on now-removed USB drives and network shares. They're among the most reliable evidence of what a user or attacker actually accessed.
An insider threat investigation: a departing employee is suspected of copying confidential files to a USB drive on their last day. The USB drive is gone. The employee claims they never connected a USB. LNK files in the user's profile tell a different story: shortcut files in %APPDATA%\Microsoft\Windows\Recent point to files on a volume with a specific serial number. That serial number matches a USB drive shown in the registry (USBSTOR). The LNK files include the volume label, drive letter at time of access, and the full path of files the employee opened on that drive. The files opened match the confidential documents under investigation. The USB drive may be gone but the evidence remains.
LNK File Structure and Forensic Value
Windows automatically creates LNK (shortcut) files for recently accessed files and applications. They contain metadata about the target file that persists even after the target is deleted or the source media is removed.
| LNK field | Forensic value |
|---|---|
| Target path | Full path of the file that was opened — even if it was on a USB or network share |
| Target file size | Size of the file at the time it was accessed — shows something was there even if the file is gone |
| LNK created timestamp | When the shortcut was first created — corresponds to first time the target file was opened |
| LNK modified timestamp | When the shortcut was last updated — corresponds to most recent time the target file was opened |
| Target MAC timestamps | The M/A/C timestamps of the target file at the time it was accessed — preserved in the LNK even after the file changes or is deleted |
| Volume information | Drive type (fixed/removable/network), volume serial number, volume label — unique identifier for the storage media |
| Machine ID | NetBIOS name of the machine that created the LNK — proves which host the file was accessed from |
| MAC address (first NIC) | MAC address of the machine's first network adapter — additional system identification |
LNK File Locations
LNK File Locations on Windows
═══════════════════════════════════════════════════════════════════
Recent files (automatically created):
%APPDATA%\Microsoft\Windows\Recent\
→ One .lnk per recently accessed file
→ Typically holds ~149 entries before oldest overwritten
Recent items per-application:
%APPDATA%\Microsoft\Windows\Recent\AutomaticDestinations\
→ Jump List automatic destinations (.automaticDestinations-ms)
Pinned items (user-added):
%APPDATA%\Microsoft\Windows\Recent\CustomDestinations\
→ Jump List custom destinations (.customDestinations-ms)
Desktop shortcuts:
%USERPROFILE%\Desktop\*.lnk
→ User-created shortcuts — can point to any path
Start Menu:
%APPDATA%\Microsoft\Windows\Start Menu\Programs\*.lnk
→ Application shortcuts — shows what's installed
Pinned taskbar items:
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\
→ Long-lived shortcuts to frequently used apps
Parsing LNK Files with LECmd
:: Parse all LNK files for a user with LECmd (Eric Zimmermann)
:: Parse all LNK files in a user's Recent folder
LECmd.exe -d "D:\evidence\C\Users\jsmith\AppData\Roaming\Microsoft\Windows\Recent" ^
--csv "D:\analysis\lnk" --csvf lnk-jsmith.csv -q
:: Parse all users at once
LECmd.exe -d "D:\evidence\C\Users" -r ^
--csv "D:\analysis\lnk" --csvf lnk-allusers.csv -q
:: Key columns in CSV output:
:: SourceFile — path of the .lnk file itself
:: SourceCreated — when the .lnk was created (≈ first access of target)
:: SourceModified — when the .lnk was last updated (≈ last access of target)
:: TargetCreated — target file's creation time (captured at LNK creation)
:: TargetModified — target file's modified time
:: TargetLastAccessed— target file's last access time
:: TargetFullPath — full path to the target (including original drive letter)
:: TargetFileSize — size of the target file
:: VolumeType — Fixed, Removable, Network, CDROM
:: VolumeSerialNumber— unique serial number of the volume
:: VolumeLabel — volume label (e.g., "MY_USB", "FINANCE_SHARE")
:: LocalBasePath
:: CommonPathSuffix
:: MachineID — NetBIOS name of machine that created the LNK
:: MACAddress — MAC of first NIC on the machine that created LNK# Find LNK files pointing to removable/USB drives
$lnk = Import-Csv "D:\analysis\lnk\lnk-allusers.csv"
# Filter for removable media access
$lnk | Where-Object { $_.VolumeType -eq "Removable" } |
Select-Object SourceModified, TargetFullPath, VolumeSerialNumber, VolumeLabel, TargetFileSize |
Sort-Object SourceModified |
Format-Table -AutoSize
# Cross-reference: which USB serial numbers show up in registry?
# HKLM\SYSTEM\CurrentControlSet\Enum\USBSTOR\
# Each subkey is a device, with subkeys for serial numbers
# The VolumeGUID under MountedDevices can link serial number to volume GUIDJump Lists
Jump Lists are extended per-application recent document lists. They're stored in the AutomaticDestinations and CustomDestinations folders and are essentially collections of LNK entries organized by application.
Jump List Filename Structure
═══════════════════════════════════════════════════════════════════
Filename format: {AppID}.automaticDestinations-ms
AppID = 16-character hex ID that maps to a specific application
Common AppIDs:
1b4dd67f29cb1962 → Windows Explorer
5f7b5f1e01b83767 → Notepad
9b9cdc69c1c24e2b → Microsoft Word
ae8de2b5c5b7e2b4 → Microsoft Excel
7e4dca80246863e3 → PowerShell
b91d38f534dfb82e → cmd.exe
b4d404b45e7f8ad3 → Remote Desktop Connection
9965213adc1ea4ba → Internet Explorer
a8a7c61d0f7fd8f3 → Google Chrome (varies by version)
Use the AppIDs to identify which application was used to open files
For example: a file appearing in the Word AppID jump list was
opened with Word, not just browsed in Explorer.
:: Parse Jump Lists with JLECmd (Eric Zimmermann)
:: Parse all jump lists for all users
JLECmd.exe -d "D:\evidence\C\Users" -r ^
--csv "D:\analysis\jumplists" ^
--csvf jumplists.csv -q
:: JLECmd output:
:: SourceFile — path to the .automaticDestinations-ms file
:: AppId — application ID (look up to identify the app)
:: AppIdDescription — JLECmd translates known AppIDs to app names
:: TargetCreated — target file creation time
:: TargetModified— target file modification time
:: TargetAccessed— target file last access time
:: TargetFullPath— full path to the target file
:: VolumeSerialNumber
:: VolumeLabel
:: MachineID
:: Interaction — 0 = recent file, 1 = pinned, 2 = taskForensic Patterns to Look For
| Pattern | What it suggests |
|---|---|
LNK files pointing to paths like D:\staging\ or E:\data_export\ on removable media | Data was staged/accessed on an external drive — even if the drive is no longer connected |
LNK files with VolumeType=Network pointing to unusual shares (\\fileserver\secret$\) | User (or attacker using user's session) accessed network shares — reveals reconnaissance or data staging locations |
| Jump List entries for scripting tools (PowerShell, cmd, Python) pointing to scripts in temp directories | Scripts were executed from suspicious locations — cross-reference with Prefetch |
| MachineID in LNK file doesn't match the system being investigated | LNK was created on a different machine and copied here — pivot to the original machine |
| LNK file exists for a target file that no longer exists and has no MFT record | Target file existed long enough to generate the LNK then was deleted and the MFT record overwritten — LNK is your only remaining evidence of the file |
Q & A
Q: Can LNK files help establish that an attacker moved laterally from one host to another?
Yes, in two ways. First: if an attacker on Host A used Remote Desktop or mapped a network drive to Host B, LNK files on Host A will show recently accessed files on \\HostB\ or the RDP connection target. Second: the MachineID and MAC address fields in LNK files record the system where the LNK was created. If you find a LNK on Host B that has Host A's MachineID, it was created on Host A and copied to Host B — indicating the attacker moved files between systems. Combine this with Event 4648 (explicit credential use) and Prefetch for psexec.exe or mstsc.exe on the source host to build a complete lateral movement picture.