Eye Describe Anatomy

LNK Total Binary Dissection

The definitive forensic guide to the MS-SHLLINK Shell Link format used across Windows.

Live Byte Selection

Select any field in the map to reveal a deep forensic dive.

The Three Pillars of Windows Artifacts

Windows maintains three distinct artifact types that record file and application access history. All three share a common underlying structure — the Shell Link (LNK) binary format — but they wrap it in different containers and enrich it with different metadata layers:

  • LNK Files (.lnk): Standalone shell shortcut files, one per accessed item. Found in \Recent\.
  • Automatic Destinations: OLE Compound File containers, system-managed, tracking recently and frequently accessed items per application.
  • Custom Destinations: Raw binary files, application-managed or user-driven, tracking pinned and task items.

This page focuses on the core LNK binary payload found inside all three containers.

Full Logical Dissection Reference

Offset Size Field Name Forensic Meaning & Value

ExtraData Block Signatures

SignatureBlock NameSignificance
0xA0000003TrackerDataBlockContains Machine NetBIOS, MAC Address, & Droid GUIDs.
0xA0000009PropertyStoreBlockSerialized metadata (Author, Last_Author, Title, EXIF).
0xA0000001EnvironmentVarBlockTarget paths using variables like %APPDATA%.
0xA0000006DarwinDataBlockWindows Installer (MSI) application component ID.
0xA000000BKnownFolderBlockSystem folder GUID (e.g. Startup, Downloads).
0xA0000002ConsoleDataBlockCommand prompt styling; reveals hidden 1x1 shell execution.
0xA0000008ShimDataBlockApplied Compatibility Shims (.sdb) - possible persistence.

LinkFlags Bitmask (0x14)

MaskFlagForensic Result
0x0001HasTargetIDListEnables the IDList section containing Shell breadcrumbs & MFT references.
0x0002HasLinkInfoEnables LinkInfo section containing Volume Serial Numbers & Local Paths.
0x0020HasArgumentsEnables StringData containing command-line arguments (critical for malware).
0x0080IsUnicodeIndicates StringData blocks are UTF-16LE encoded.
From reading to doing

Stop hex-diving — let Crow-Eye parse every LNK

You've just dissected a Shell Link byte by byte. Crow-Eye does this across the whole evidence set automatically — recovering target paths, the three MAC timestamps, the tracker block's machine ID & NIC MAC address, and the full Shell IDList — and lays them on a timeline.

Download Crow-Eye