Hello everyone.
In this video you will learn how to analyze link files.
What is the link file?
Link files are shortcut files in the Windows operating system.
These files contain the necessary information to access another data object and help Windows run faster.
Link files can be created automatically by users or the operating system.
These files contain a lot of data that can be useful for analysis, such as the file's original path,
size unit, serial number, network share and host MAC Address.
Forensic value of the link files from a forensic standpoint.
Link files can provide valuable information that can help us during a digital forensic investigation
or incident response.
Link files can help us to find files that may no longer be available on the system.
Link files may be stored on a USB drive or on a network share.
By passing the link file, valuable information about the file can be revealed.
Link Files Location on Windows Systems.
You can find the link files in the specific directories.
One of them is C users.
Your username appdata roaming Microsoft windows and recent and the another directory is office and recent.
You can find the equivalence of the same recent folders on Windows XP C documents and Settings directory.
You can see the screenshots in recent directories below.
Analysis of the link file before analyzing these files, they must be obtained from relevant locations.
After the files are collected, tools such as Exiftool, Le CMD and T, z works Windows Link parsing
utility can be used for analysis.
We will perform the analysis using exiftool and let EMD.
Exiftool run the tool without option to see the manual page.
This is an exhaustive page, so I snipped the output.
When you run the exiftool on any link file without option, it will give you information about the relevant
link file.
Like.
And we can also perform the analysis using the CMD tool.
I will demonstrate the usage of these tools at the end of this video.
Analyze the output after the process is completed.
It presents a CSV file to us.
I will teach you what kind of information are parsed with these tools.
Now let's apply what we learned.
Let's go to the directory where our link files are present.
See.
Users your username.
App data.
Roaming.
Microsoft.
Windows.
And recent items.
As you know, this is just one of the folders that we expect to see link files.
When we look at here, we can see that there are 138 items present in this folder.
For example, let's analyze the Excel file named ASD.
Let's go to our tools directory and type CMD to open a command line.
Our EXIF tool is in that directory.
Let's type EXIF and tap.
We will give this file's path as an input.
Click here and copy the full path, then paste it on the command line.
You should add your file's name here.
Then tap notice that the extension is Dot, L and K.
The rule is all shortcut files, extension, R, dot, l and k.
I want to show you a critical point that when I click this file.
The system will prompt and say that this file doesn't exist.
It means that the user has deleted the file, but the link file associated with that file exists.
And that's why forensic scientists analyse link files.
So let's keep continue with our analyze and press enter.
You can see the path for the link file.
Here and at the bottom.
The file's actual location is also available.
This is the bite of the link file.
And that is the size of the main file.
Timestamps on the top belong to the link file, but the following timestamps belong to the actual file.
Drive type is fixed, disk drive, serial number is there.
And lastly, the machine ID is here.
Press enter.
Now let's use another tool like MD type, like MD and TAB to see the manual page.
Let's clear the screen.
Let's tap.
This f.
Copy the directory of the shortcut file.
Then add our file name.
Since I have so many shortcut files in that directory, I will only parse the previous file.
But you can replace dash F with dash D and specify a directory name to list information about all files.
Now I will write dash, dash, csv and.to generate output in our current directory.
Enter and it has created the csv file in here.
Let's double click.
I will make this full screen.
As you see, the output is chaotic.
We can fix this by doing these steps.
At first, select the first column, then click data.
Text to columns.
Deli meats.
Uncheck tab and check comma.
Next and finish this time, click on the corner and double click the line between two columns.
We have fixed the file.
It's time to examine it.
I have mentioned almost all of them.
Some of these details are out of this training scope.
I can see the Mac address of the system that created this file and the vendor of the network card is
unknown.
This video is over.
See you on the next video.