Windows Shortcut (LNK)
| Format | Windows Shortcut (LNK) |
|---|---|
| Short name | LNK |
| Category | execution |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Windows shell link files, created when files are opened (Recent folder, Office recent items) and inside Jump Lists. They record the target's path, size and MAC times at the moment the link was written, the volume serial number and type, network share names and often, in the distributed link tracker block, the NetBIOS name of the machine and its MAC address (in the version-1 GUIDs). Evidence of files and volumes that may no longer exist.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 | L..................F | Header size 0x4C and LinkCLSID {00021401-0000-0000-C000-000000000046} |
Known extensions
.lnk
References
- [MS-SHLLINK]: Shell Link (.LNK) Binary File Format, v10.0 (Microsoft) https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/16cb4ca1-9339-4d0c-a68d-bf1d6cc0f943
- Windows Shortcut File (LNK) format (libyal/liblnk) https://github.com/libyal/liblnk/blob/main/documentation/Windows%20Shortcut%20File%20(LNK)%20format.asciidoc
- ForensicsWiki — LNK https://forensics.wiki/lnk/
Cite this entry
Crush Format Reference, “Windows Shortcut (LNK)”. https://kalink0.github.io/crush-forensics/formats/lnk/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction