LNK files are a relatively simple but valuable artifact for the forensics investigator. They are shortcut files that link to an application or file commonly found on a user’s desktop, or throughout a system and end with an.LNK extension. LNK files can be created by the user, or automatically by the Windows operating system.
- USGS DEM File Reader is a reliable solutions for users who deal with USGS DEM files. It reads enough information for generating a 3D terrain. A sample application is included with code to show how to interpret the header information and iterate through the elevation points.
- Portable Link Viewer is a very small and easy-to-use program whose purpose is to provide information on LNK-formatted files. It has a short feature-set that make the app accessible to all user groups.
- You can find this information in the file’s properties. On a Windows computer, just right-click the file and click properties, and look for the file type under “Type of File.” On a Mac computer, right-click the file and click “More info,” and look for the file type under “Kind.” Step 4: Get help from a developer.
Related: Jpeg File Reader - Lit File Reader - Lit File Reader Mac - File Reader Cdr - File Reader Dat
- License: Freeware
Do not worry if you encounter email corruption problems in Microsoft Outlook email client and it becomes not accessible for any reason. There is no need to panic even if you cannot restore email folders using backup copies. Try the pst filereader services, provided by PST FileReader Free and feel the difference with other solutions. This program runs under all supported software configurations, you may get the installer of pst filereader from the website of PST FileReader Free without additional compatibility checks. Pdf measure tool.
- Platform: WinOther
- Publisher:PST File Reader.inc
- Date: 19-11-2012
- Size: 1905 KB
- License: Freeware
Java Shape FileReader was developed as a lightweight and accessible Java library that manages to read ESRI shape files.
You can now use the Open Source Java Shape FileReader library to further improve your development process.
.
- Platform: WinOther
- Publisher:Vladimir Alarcon
- Date:
- License: Shareware
USGS DEM FileReader is a reliable solutions for users who deal with USGS DEM files. It reads enough information for generating a 3D terrain.
A sample application is included with code to show how to interpret the header information and iterate through the elevation points. For simplicity, the sample application generates a bitmap to show relief shading.
.
- Platform: WinOther
- Publisher:jakesee
- Date:
- License: Freeware
Kernel for OST filereader is a complete standalone utility provides its user with a complete solution to view the OST file content. The most stunning aspect about the software is its ability to provide the complete preview of content of OST files even if Exchange Server is absent. Apart from this, the tool is well integrated with search option. This search option feature allows its user to find out OST files within disk or even specific items in just few minutes. In addition, now one may also have an easy access & view corrupt OST files.
- Platform: Windows
- Publisher:OST PST Converter
- Date: 02-03-2015
- Size: 4526 KB
- License: Freeware
Making use of Kernel for Outlook PST viewer is quite easy and time consuming. As soon as the software gets installed over user system it will conduct the process in a fraction of seconds. This standalone utility has a built-in search option which helps user in locating the PST file on computer. Once files are located tool display the content in left pane, user can use it further for their purpose.
Using the free PST reader tool is quite easy for users; it is embedded with self-descriptive user interface and allow user to view data in some simple steps.
- Platform: Windows
- Publisher:Repair PST
- Date: 07-01-2011
- Size: 2375 KB
- License: Shareware
Have you trouble with your MS Access database? MS Access Database Corrupt? Don't be frustrated!! Perfect Data Solutions having all the solution for corrupted MS Access Files. Download freeware MS Access Repair software from our website and repair corrupt access database and evaluate its functionality and & efficiency of access recovery. PDS Access Recovery is also work as Access filereader software that read access files and extract access file contents from heavily corrupted MDB database.
Recover corrupt mdb file & fix access database with PDS Access Database Recovery software.
- Platform: Windows
- Publisher:Microsoft Access Database Reader
- Date: 21-03-2011
- Size: 1054 KB
- License: Freeware
Boustrophedon-Reader is a small, smart and unique Java-based application that represents an experimental visual filereader, useful e.g. for people interested in speed-reading.
The software mirrors every second text line to enable your eyes to continue reading at the end of the line without returning the eyes in vain to the next line and thus spending a little amount of time.
There are two modes for mirroring, one mirroring each character, the other just inverting the order of the words without mirroring them.
- Platform: WinOther
- Publisher:Arne Bachmann
- Date:
- License: Shareware
4Videosoft Free PDF FileReader is an easy-to-use application designed for users to read their PDF files, acting as a free program to view and print PDF files. Best of all, it is absolutely FREE, proving that you really can get a whole lot of something for nothing.
4Videosoft Free PDF FileReader provides a very convenient way for you to read any PDF files. At the same time, you can choose any pages you want to read, for all the pages of the PDF file are listed in the left navigation, so it is very convenient and save you a lot of time if you are not interested in part of the files.
- Platform: Windows
- Publisher:4Videosoft Studio
- Date:
- Size: 8345 KB
- License: Freeware
This software like a Text Log FileReader.
Bell Log FileReader License - Creative Commons Attribution Non-Commercial License V2.0.
- Platform: WinOther
- Publisher:Belllogfileread
- Date:
- Size: 4218 KB
- License: Freeware
It is a txt filereader wich handle text files (.txt) no matter how big they are. Pocket PC are often non-responssive when you try to open big txt files. This reader solve the problem because it divide the text into small chunks, easy loadable.
BigText fileReader for PPC License - GNU General Public License (GPL).
- Platform: WinOther
- Publisher:Bigtextreader
- Date:
- License: Shareware
BKF Recovery Software: Easily Restore BKF files with this BKF filereader. Repair My Backup will open and restore Microsoft Backup files, including damaged or corrupt files. Repair My Backup is a fast and easy way to extract BKF files. Download Now.
.
- Platform: Tablets, Windows
- Publisher:GetData Software Company
- Date:
- Size: 7127 KB
- License: Freeware
This application FileReader for Pages will introduce a document viewer for Mobile introduced that should be used in the machine. Working on FileReader for Pages such as Word, Excel, PowerPoint and document viewer for mobile because they are provided free, in general. Therefore, the load may decide to work together. So I strongly recommend that our volunteers do a good enough quality to be loaded for use.
This application guide the best reading tools. It can help you to easily manage, and open all the ebooks on your phone.
- Platform: Android 2.x, Android 3.x, Android 4.4, Android 4.x
- Publisher:Stephen Best Free Apps
- Date: 09-08-2014
- Size: 6246 KB
- License: Shareware
SQL file Recovery sort out the problems occurred in SQL Server 2000, 2005 & 2008 due to virus attacks, low disk space, trying to access or copy the mdf file while SQL database is running, defects in storage media etc? SQL files Recovery recognizes the exact reason of corruption or damage of MDF file and than provide the tool which exactly removes the damage area of MDF file. SysTools Software scans the corrupted MDF file and extracts it's. MDF filereader software is capable to repair SQL file or repair MDF file even if file shows following error messages:* PageId in the page header = (0:0)* Server can't find the requested database table* The process could not execute 'sp_replcmds' on server* Corruption error of indexes, stored procedures, triggers and database integrity.
- Platform: Windows
- Publisher:SQL Recovery
- Date:
- Size: 1638 KB
- License: Shareware
Are you searching for MDF File Recovery Software which able to reads MDF files from corrupt SQL Server? Try MDF file opener for opening corrupt MDF files efficiently. MDF File Recovery Software has 'Automated Database Creationd-deDt feature which export recovered MDF file database in SQL Server. It enables you to read MDF file in an accurate manner so that none of the database will be wasted. When you click the download button then automatically downloading will start. You don't need to be panic while downloading.
- Platform: Windows
- Publisher:MDF File Recovery Software
- Date:
- Size: 4096 KB
- License: Shareware
Reader For .lnk File Download
C# CSV Reader provides a robust CSV and fixed-width text file parser for .Net applications and asp.net websites. The 'C# CSV Reader' package designed as a .NET library that you can add to your .NET solution and get parsing with ease. Flat files a popular medium for data exchange. C# CSV reader allows you to read a variety of different formats with low memory footprint and high error tolerance. This saves you the time of developing and debugging from scratch. C# Data Reader is a no fuss library that is quick to deliver results.
- Platform: Windows
- Publisher:Data Migration Lab
- Date: 04-12-2015
- Size: 8 KB
- License: Shareware
SysTools ZIP Repair is a very simple option to Recover ZIP file if you really feel uncomfortable with other software due to high cost, less featured availability & maintenance problem or high hardware or software requirement. Zip Repair Software is used to repair or reconstruct the Corrupted ZIP files. SysTools Zip Repair Software is a powerful Zip Recovery utility to open Zip files & Extract Zip files from corrupted Zip files. SysTools Zip Repair tool support multiple file format & restore music, images, documents, emails etc from damaged Zip files created using WinZip, WinRAR or any other compression utilities.
- Platform: Windows
- Publisher:Zip Repair
- Date: 22-08-2009
- Size: 977 KB
- License: Freeware
An experimental filereader, useful for people interested in speed-reading. There are several modes for mirroring characters, words or lines.
- Platform: Linux, Mac, Windows
- Publisher:boustrophedon.sourceforge.net
- Date: 12-09-2012
- Size: 97 KB
- License: Freeware
Praetorians (real-time-strategy) multi-player sequence (savegame .sec file) reader . Extract the Players GameDatas (stats) from a Sequence file . Universal audio plugins.
- Platform: Linux, Windows
- Publisher:wiki.praetorians.abacvs.org
- Date: 19-06-2012
- Size: 92 KB
- License: Shareware
This function is used for loading binary STL filesThere are already two stlread.m files available on the mathworks file exchange site. Harlev's version reads in the data and returns matrices with X/Y/Z formatted vertex data. Johnson's program reads in the data and returns Face/Vertex/Normal matrices.This submission also exports Face/Vertex/Normal matrices, but runs about 30 times faster than Johnson's version and 13 times faster than Harlev's version (which doesn't export face normal data).This submission will also properly read in color values (if present) and the STL file title.
- Platform: Matlab, Scripts
- Publisher:Francis Esmonde-White
- Date: 27-06-2013
- Size: 10 KB
- License: Shareware
This library contains helper functions to read image frames into matlab from Video file using DirectShow. This library has borrowed codes from Ashwin Thangali's 'DirectShow (DirectX) based AVI file reader', and it can read multiple video formats besides avi.Features:a) can read frames from rmvb, avi, etc.b) handles most codecs installed on the systemd) its implementation is only based on the IMediaDet interface-- Depending on your Matlab version, the .mexw32 files may need to be renamed as .
- Platform: Matlab, Scripts
- Publisher:Lei Wang
- Date: 07-04-2013
- Size: 20 KB
LNK files (labels or Windows shortcut files) are typically files which are created by the Windows OS automatically, whenever a user opens their files. These files are used by the operating system to secure quick access to a certain file. In addition, some of these files can be created by users themselves to make their activities easier.
Fig.1. Windows Desktop Shortcuts
Location
Normally, most of LNK-files are located on the following paths:
- For Windows 7 to 10: C:Users%USERNAME%AppDataRoamingMicrosoftWindowsRecent
- For Windows XP: C:Documents and Settings%USERNAME%Recent
However, there many other places where investigators can find LNK files:
- On the desktop (such shortcuts are usually created by users to secure quick access to documents and apps)
- C:Users%USERNAME%AppDataRoamingMicrosoftOfficeRecent (for Microsoft Office documents on Windows 7 to 10)
- C:Users%USERNAME%Downloads (Sometimes users send shortcuts via e-mails to other users instead of the documents to be delivered. Consequently, other users download those shortcuts. Again, this is for Windows 7 to 10)
- Startup folder
- Etc.
Fig.2. Shortcuts Found in the Recent Folder as shown by Belkasoft Evidence Center
Contents of Shortcuts
Before Microsoft published the information about the format of LNK files, researchers had tried to describe the format by themselves. The complexity of such research is that the different shortcuts contains different data. Correspondingly, when you analyze one shortcut type, the contents and amount of data may be different than when analyzing another shortcut type. Besides, in Windows 10, new fields are present that cannot be found in earlier versions.
So, what kind of information does a LNK file contain? Belkasoft Evidence Center digital forensic software displays the following three sections with data related to LNK file: 'Metadata', 'Origin', and 'File'.
Fig.3. 'Metadata' Section Contains Multiple Details About a Target File
The most important data displayed by the 'Metadata' Section include:
- Source path of a file and its time tags (Full path, Target file access time (UTC), Target file creation time (UTC), Target file modification time (UTC))
- Drive type
- Volume serial number (Drive serial number)
- Volume label
- NetBIOS name
- Target file size (bytes), i.e. the size of the file with which the shortcut is associated
As you can see, such fields as 'Droid file' and 'Birth droid file' can be found. DROID (Digital Record Object Identification) is the individual profile of a file. This structure (i.e. that of a droid file) can be used by the Link Tracking Service in order to determine whether the file has been copied or moved.
Fig.4. 'Origin' Section Tells Where Selected Artifact Was Extracted From
Fig.5. 'File' Section Shows File System Metadata of a LNK File
In the 'File' section you can see the MAC-address of the device on which this shortcut was created. This information may help you identify the device associated when the LNK file was created.
While conducting an investigation, one should pay attention to the time tags of a LNK file. The reason for that is that, as a rule, the time of file creation corresponds either to the time the file was created by a user or to the time of the first file access event associated with a shortcut. As for the time modification time, it normally corresponds to the last file access event associated with a shortcut.
File Recovery
If one examines the 'Recent' folder described above, up to 149 LNK files will be found there. What should be done, if the shortcut we need was deleted? The answer is simple: for sure, it should be recovered! Recovery of LNK-files can be executed with the file header signature, hex: 4C 00 00 00.
In order to specify the file header, one should start with the program menu: 'Tools'—'Options'. Then the 'Carving' tab is needed. Click on 'Add' button to create a new signature. You can learn about the carving methods with Belkasoft Evidence Center in greater details in the article 'Carving and its Implementations in Digital Forensics'.
Fig.6. Adding a Custom Signature (Header)
Using LNK Files with Information Security Incidents
Compromising an Attacked System
Over 90% of malware is distributed via e-mails. Normally, malware e-mails contain either a link to a network resource or a specifically designed document. If such a document is opened, malware will be downloaded to a machine.
Likewise, LINK files are used for hacking attacks.
Reader For .lnk File Format
Fig.7. 'Metadata' Section Associated with a Malicious LNK file
The general rule is that such a LNK file contains a PowerShell code which is executed when users try to open the shortcuts previously sent to them. As you can see in Fig.7, such shortcuts can be easily detected with Belkasoft Evidence Center: there is a path to an executable powershell.exe in the metadata. In the 'Arguments' field, there are arguments of a PowerShell command and encrypted 'payload'.
Embedding in a Compromised System
One of the methods to use LNK files is to embed them in a compromised system. In order to activate malware whenever a corresponding machine is turned on, the following trick can be utilized. A LNK file with a link to an executable malware file (for example, to a file with the loader code) should be created, a shortcut is to be placed at the following address: C:Users%User profile%AppDataRoamingMicrosoftWindowsStart MenuProgramsStartup.
Reader For .lnk File
In this case, as soon as a machine is launched, the malware will be activated as well. Such shortcuts can be found in the 'File system' tab of Belkasoft Evidence Center.
Fig.8. 'PhonerLite.lnk' Shortcut in Startup
Conclusion
LNK files are Windows system files which are important in a digital forensic and incident response investigations. They may be created automatically by Windows or manually by a user. With the help of these files you can prove execution of a program, opening a document or a malicious code start up.
Reader For .lnk File Extension
Belkasoft Evidence Center can help you to locate existing LNK files, recover deleted ones and help to analyze their contents.
Reader For .lnk Files
