lnk_info

information about Microsoft Windows LNK files

lnk_info shows information about LNK files.

  • creation_date: <string> date in ISO8601 format.
  • access_date: <string> date in ISO8601 format.
  • modification_date: <string> date in ISO8601 format.
  • link_flags: <list of strings> basic properties of the LNK file.
  • target_path: <string> (optional) target path from Link Target Identifier fields.
  • icon_location: <string> (optional) path to the icon location.
  • mac_address: <string> (optional) network MAC address.
  • mac_vendor_name: <string> (optional) network vendor name from MAC address.
  • machine_id: <string> (optional) computer name.
  • working_directory: <string> (optional) target working directory.
  • relative_path: <string> (optional) target file relative path.
  • command_line_arguments: <string> (optional).
  • volume_serial_number: <string> (optional) disk volume serial number.
  • volume_label: <string> (optional) disk volume label.
  • local_path: <string> (optional).
  • common_path: <string> (optional).
  • network_share_name: <string> (optional).
  • extra_data:
    • dlt_properties: <dictionary> dlt properties of the LNK file.
      • birth_droid_file_id: <string>,
      • droid_file_id: <string>,
      • birth_droid_volume_id: <string>,
      • droid_volume_id: <string>
  • link_target_id_list: <list of dictionaries> Every entry contains the following fields:
    • clsid: <string>,
    • item_type: <integer>,
    • item_type_str: <string>
  • header: <dictionary>.
    • show_window: <integer>,
    • show_window_str: <string>,
    • hot_key: <string>,
    • file_size: <integer>
{
  "data": {
        ...
    "attributes" : {
      ...
      "lnkcheck": {
        "creation_date": "<string:ISO8601>", 
        "access_date": "<string:ISO8601>", 
        "modification_date": "<string:ISO8601>", 
        "link_flags": ["<string>",...],
        "target_path": "<string>",
        "icon_location": "<string>",
        "mac_address": "<string>",
        "mac_vendor_name": "<string>",
        "machine_id": "<string>",
        "working_directory": "<string>",
        "relative_path": "<string>",
        "command_line_arguments": "<string>",
        "volume_serial_number": "<string>",
        "volume_label": "<string>", 
        "local_path": "<string>",
        "common_path": "<string>",
        "network_share_name": "<string>"
        "extra_data": {
          "dlt_properties": {
            "birth_droid_file_id": "<string>", 
            "droid_file_id": "<string>", 
            "birth_droid_volume_id": "<string>", 
            "droid_volume_id": "<string>"
          }
        }
        "shell_item": {
          "clsid": "<string>",
          "item_type": "<integer>",
          "item_type_str":"<string>"
        }
        "header": {
          "show_window": "<integer>", 
          "show_window_str": "<string>", 
          "hot_key": "<string>", 
          "file_size": "<integer>"
        },
    }
  }
}
{
  "data": {
    "attributes": {
      "lnkcheck": {
        "common_path": "C:\\Program Files\\Greenrain\\Submission\\unins000.exe", 
        "machine_id": "445817", 
        "modification_date": "2016-07-27T18:25:43.570251Z", 
        "link_flags": [
          "HasLinkInfo", 
          "HasRelativePath", 
          "IsUnicode", 
          "HasWorkingDir", 
          "HasExprString", 
          "EnableTargetMetadata"
        ], 
        "vhash": "1234567890", 
        "network_share_name": "\\\\USER\\HTMLQA", 
        "creation_date": "2016-06-28T21:49:46.108805Z", 
        "header": {
          "show_window": 1, 
          "show_window_str": "SW_NORMAL", 
          "hot_key": "(0+0)", 
          "file_size": 6486
        }, 
        "relative_path": "..\\..\\..\\..\\..\\..\\Program Files\\Greenrain\\Submission\\unins000.exe", 
        "local_path": "C:\\Program Files\\Greenrain\\Submission\\unins000.exe", 
        "working_directory": "C:\\Program Files\\Greenrain\\Submission", 
        "mac_address": "00:50:56:a0:09:e3", 
        "access_date": "2016-06-28T21:49:46.108805Z", 
        "extra_data": {
          "dlt_properties": {
            "birth_droid_file_id": "33a6be73-453c-11e6-9444-00155d0b8406", 
            "droid_file_id": "33a6be73-453c-11e6-9444-00155d0b8406", 
            "birth_droid_volume_id": "85cdf8e2-5f07-4f3a-a953-67709a1e8150", 
            "droid_volume_id": "85cdf8e2-5f07-4f3a-a953-67709a1e8150"
          }
        }, 
        "mac_vendor_name": "VMware, Inc."
      } 
    }
  }
}