All the files are my own files and no one has sent me them. These were all working a couple of days ago. I've got a feeling this is a virus but I just need to rectify the problem. If I can only open these files in windows, is there a way of opening them on there and doing something so I can use them on a mac? SuperUser reader Jez wants to know how to open.lnk files to view the ‘contents’ and edit them if needed: A.lnk file in Windows is an actual file intended to be a shortcut to another file, but I really do want to view the contents of the.lnk file itself. A lnk file contains information like: Local Base Path to the Target file This is the folder/file which the LNK file is pointing to; MAC Times for the LNK file The timestamps when the LNK file was created, modified and last accessed; File size of the LNK File; Keyboard shortcut for the LNK file The LNK file can be associated with a keyboard. The IShellLink interface lets you manipulate.lnk files, though it's a bit of a pain to use from C#. This article has some code implementing the necessary interop gubbins. You can find the code from the article here but the page doesn't seem to work in Firefox. It does work in IE.
.LNK is the extension used by Shortcut Files in Windows. We normally place a ton of shortcuts on our desktop and sometimes in other folders as well. These shortcuts (LNK) files are binary files that contain information needed by windows to access the target file or folder.
A lnk file contains information like:
Even though the destination application may have been deleted/moved, their shortcuts can still remain. This can help forensic investigators understand what was executed/accessed on the system.
Powerforensics is a PowerShell framework created for Hard Drive Forensic analysis by Jared Atkinson
In order to use it, we need to install the PowerForensics module and import it.
Get-ForensicShellLink-VolumeName.H:|Export-Exceldemo.csv-AutoSize-FreezeTopRow |
Above command will create an excel file named demo.csv whose column will be auto-sized and a frozen top row
Analysing the above we can conclude:
0
[My Pictures Lorpix]Z:Lorpix
. Lorpix could be a folder on a shared network folder mapped as Z:. We can investigate the Hive files to find the network pathHere, Remnux is a shortcut on my desktop to a virtual machine in virtualbox. We can analyze it by using: