Eye Describe Anatomy

LNK Total Binary Dissection

The definitive forensic guide to the Windows shortcut (.lnk) file format — the MS-SHLLINK Shell Link structure used across Windows, and what a shortcut reveals about the file it points to.

Live Byte Selection

Select any field in the map to reveal a deep forensic dive.

The Three Pillars of Windows Artifacts

Windows maintains three distinct artifact types that record file and application access history. All three share a common underlying structure — the Shell Link (LNK) binary format — but they wrap it in different containers and enrich it with different metadata layers:

  • LNK Files (.lnk): Standalone shell shortcut files, one per accessed item. Found in \Recent\.
  • Automatic Destinations: OLE Compound File containers, system-managed, tracking recently and frequently accessed items per application.
  • Custom Destinations: Raw binary files, application-managed or user-driven, tracking pinned and task items.

This page focuses on the core LNK binary payload found inside all three containers.

Full Logical Dissection Reference

Offset Size Field Name Forensic Meaning & Value

ExtraData Block Signatures

SignatureBlock NameSignificance
0xA0000003TrackerDataBlockContains Machine NetBIOS, MAC Address, & Droid GUIDs.
0xA0000009PropertyStoreBlockSerialized metadata (Author, Last_Author, Title, EXIF).
0xA0000001EnvironmentVarBlockTarget paths using variables like %APPDATA%.
0xA0000006DarwinDataBlockWindows Installer (MSI) application component ID.
0xA000000BKnownFolderBlockSystem folder GUID (e.g. Startup, Downloads).
0xA0000002ConsoleDataBlockCommand prompt styling; reveals hidden 1x1 shell execution.
0xA0000008ShimDataBlockApplied Compatibility Shims (.sdb) - possible persistence.

LinkFlags Bitmask (0x14)

MaskFlagForensic Result
0x0001HasTargetIDListEnables the IDList section containing Shell breadcrumbs & MFT references.
0x0002HasLinkInfoEnables LinkInfo section containing Volume Serial Numbers & Local Paths.
0x0020HasArgumentsEnables StringData containing command-line arguments (critical for malware).
0x0080IsUnicodeIndicates StringData blocks are UTF-16LE encoded.
From reading to doing

Stop hex-diving — let Crow-Eye parse every LNK

You've just dissected a Shell Link byte by byte. Crow-Eye does this across the whole evidence set automatically — recovering target paths, the three MAC timestamps, the tracker block's machine ID & NIC MAC address, and the full Shell IDList — and lays them on a timeline.

Download Crow-Eye

Frequently Asked Questions

What does a Windows LNK file reveal in an investigation?

The full path of the target, the target's created, modified and accessed times as they were when the shortcut was written, the volume serial number, and often a tracker block holding the machine ID and a NIC MAC address of the system where it was created.

Where are LNK files found on Windows?

Automatically created shortcuts live in the user's Recent folder under AppData. Others sit on the Desktop, in the Start Menu, and anywhere a user or installer placed them, so both automatic and deliberate shortcuts are worth collecting.

Does a LNK file prove a document was opened?

A shortcut in the Recent folder is good evidence the target was opened through the shell, and it preserves the target's timestamps at that moment even if the file has since been deleted or moved. It does not by itself say who opened it or from which application.

Can a LNK file point at a file that no longer exists?

Yes, and that is one of its most useful properties. The shortcut retains the target's path, size and timestamps after the target is gone, which makes LNK files a common source of evidence for removed or external-media files.