Every investigation reaches a point where the filesystem stops talking. Executables are gone. Logs are rotated. Prefetch is wiped. This is where inexperienced analysts stall and where a Forensic Operator slows down, lowers the light, and listens harder.
Because Windows does not forget interaction.
Lecture 3.4 focuses on LNK files and Jump Lists, artifacts created for usability that become unintentional witnesses. They do not just record what existed. They record what a human chose to open, from where, how often, and in what sequence. This is not proof of execution. This is proof of intent and behavior.
Inside Ocsaly Academy, this is classified as Operator Intelligence. We are no longer reconstructing systems. We are reconstructing decisions.
1. LNK Files: The Shortcut That Remembers Everything
A Windows shortcut file (.lnk) is created when a user opens a file via Explorer, Desktop, or Start Menu. Its purpose is performance and convenience. Its forensic value is permanence.
A LNK file is not a pointer. It is a snapshot of context at the moment of access.
Common Storage Locations
LNK files appear in multiple user scoped locations:
C:\Users\<USER>\Desktop\C:\Users\<USER>\Recent\C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\- Embedded inside Jump Lists
Forensic Alert:
LNK artifacts are bound to the user profile. They bridge filesystem evidence directly to a specific human account.
Inside a LNK File: What the OS Encodes
LNK files follow the Microsoft Shell Link Binary File Format. When Explorer opens a target, it serializes context data into a structured binary object and commits it to disk.
[DIAGRAM: LNK internal structure showing Shell Link Header, LinkTargetIDList, LinkInfo, and ExtraData blocks]
High Value Forensic Fields
- Original target full path
- Target file size
- Target file MAC timestamps at time of access
- Volume serial number
- Volume label
- Network share name for UNC paths
- Originating machine NetBIOS name
- LNK creation, modification, and access timestamps
Critical Insight:
LNK timestamps represent user interaction time, not filesystem modification time. This distinction is essential during timeline disputes.
USB Evidence Without the USB
When a document is opened from removable media, the LNK file stores:
- Volume serial number
- Drive letter at time of access
- Volume label
Even if the USB device is destroyed, formatted, or never seized, the LNK file preserves its fingerprint.
Investigative Tip:
Volume serial numbers allow correlation with USBSTOR, MountedDevices, and SetupAPI logs to prove removable media usage beyond reasonable doubt.
Kernel Perspective: Why LNKs Persist
Explorer operates in user mode, but file open operations transition into kernel mode through NTFS drivers. Shortcut creation is handled asynchronously by the Windows Shell. The write does not depend on the target file remaining present.
This explains why LNK files survive:
- Deletion of the original document
- Secure wiping of the target path
- Partial system crashes
- User attempts to clear recent files
LNK persistence is not an accident. It is a byproduct of Windows prioritizing user experience over privacy.
2. Jump Lists: The Behavioral Ledger
Jump Lists track application centric file interaction. Right click an application icon and Windows presents recent and frequent documents associated with that application.
For a Forensic Operator, Jump Lists are compressed timelines of habit.
Storage Locations
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations\C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\
AutomaticDestinations
- Generated by the operating system
- Stored as OLE compound files
- Contain embedded LNK streams
- Named using application AppID hashes
CustomDestinations
- Application defined
- Common in Microsoft Office and media players
- Focused on user curated activity
[DIAGRAM: Jump List OLE file showing embedded LNK streams and DestList structure]
The DestList: The Core Evidence Stream
Each Jump List contains a DestList stream. This structure tracks:
- Entry order
- Access count
- Last accessed timestamp
- Pin status
- File path reference
- Entry identifiers
The DestList is unaffected by file deletion. It reflects usage, not existence.
Forensic Alert:
Uninstalling an application does not remove its Jump List. Behavioral artifacts routinely outlive the software that created them.
3. Correlating LNK Files and Jump Lists
LNK files show access context. Jump Lists show frequency and sequence. Together they form a timeline that is extremely difficult to dispute.
Example Investigation Scenario
- Sensitive spreadsheet is missing
- File does not exist on disk
- No Prefetch artifacts present
- Suspect denies ever opening the file
Correlation Steps
- LNK Artifact
- Path:
E:\finance.xlsx - Volume serial matches removable media
- Access timestamp recorded
- Path:
- Jump List Artifact
- AppID corresponds to Microsoft Excel
- Same file path appears
- Access count greater than one
- Last accessed timestamp matches LNK
- Registry Correlation
- USBSTOR entry confirms device insertion
- MountPoints2 confirms drive letter assignment
- SYSTEM hive timestamps align
This is not coincidence. This is behavioral proof.
4. Professional Tooling and Exact Procedures
Manual parsing is not acceptable at this level. We rely on validated forensic tooling.
Zimmerman Toolchain
Parsing LNK Files
LECmd.exe -d "C:\Users\Typhon\AppData\Roaming\Microsoft\Windows\Recent" --csv C:\Analysis\LNK
Parsing Jump Lists
JLECmd.exe -d "C:\Users\Typhon\AppData\Roaming\Microsoft\Windows\Recent" --csv C:\Analysis\JumpLists
Timeline Construction
- Load CSV output into Timeline Explorer
- Normalize timestamps to UTC
- Filter by filename and AppID
- Overlay USB and Registry artifacts
Investigative Tip:
Jump List timestamps are stored in FILETIME format. Always validate conversion accuracy before correlation.
5. Anti Forensics and Common Failures
Attackers often attempt to hide interaction by:
- Clearing Recent Items
- Deleting LNK files
- Using secure deletion tools on documents
What they overlook:
- Jump Lists store embedded LNK streams
- DestList entries remain intact
- Volume serial numbers remain valid forever
- Cross artifact correlation exposes deletion attempts
True erasure requires deep shell manipulation or offline profile reconstruction, which is rarely performed correctly.
Operator Intelligence Summary
LNK files and Jump Lists are not about malware. They are about choice.
They answer questions suspects cannot comfortably answer:
What did you open
How often did you return to it
From which device
Under which user account
When filesystem evidence fades, behavior remains.