analyzing-lnk-file-and-jump-list-artifacts

1# Analyzing LNK File and Jump List Artifacts
2 
3## Overview
4 
5Windows LNK (shortcut) files and Jump Lists are critical forensic artifacts that provide evidence of file access, program execution, and user behavior. LNK files are created automatically when a user opens a file through Windows Explorer or the Open/Save dialog, storing metadata about the target file including its original path, timestamps, volume serial number, NetBIOS name, and MAC address of the host system. Jump Lists, introduced in Windows 7, extend this by maintaining per-application lists of recently and frequently accessed files. These artifacts persist even after the target files are deleted, making them invaluable for establishing that a user accessed specific files at specific times.
6 
7 
8## When to Use
9 
10- When investigating security incidents that require analyzing lnk file and jump list artifacts
11- When building detection rules or threat hunting queries for this domain
12- When SOC analysts need structured procedures for this analysis type
13- When validating security monitoring coverage for related attack techniques
14 
15## Prerequisites
16 
17- LECmd (Eric Zimmerman) for LNK file parsing
18- JLECmd (Eric Zimmerman) for Jump List parsing
19- Python 3.8+ with pylnk3 or LnkParse3 libraries
20- Forensic image or triage collection from Windows system
21- Timeline Explorer for CSV analysis
22 
23## LNK File Locations
24 
25| Location | Description |
26|----------|-------------|
27…