What is a.lnk file It's a Windows Explorer shortcut. To a good first approximation it's the Windows equivalent of a Mac OS alias. And how do I deal with it on a Mac? As far as I am aware there exists no reasonable way to make use of a.lnk file on a Mac even if the thing that Windows might be able to find through it is actually available to. Oct 04, 2020 What is a.lnk file It's a Windows Explorer shortcut. To a good first approximation it's the Windows equivalent of a Mac OS alias. And how do I deal with it on a Mac? As far as I am aware there exists no reasonable way to make use of a.lnk file on a Mac even if the thing that Windows might be able to find through it is actually available to. Windows LNK Parsing Utility (lp), $210.00 tool that can be run on Windows, Linux or Mac OS-X Free (Non Open Source) Windows File Analyzer, free tool that is capable of reading and reporting on Windows shortcut files.
Download Cheat Engine 7.2 for Mac. Read before download: Cheat engine is for private and educational purposes only. Before you attach Cheat Engine to a process, please make sure that you are not violating the EULA/TOS of the specific game/application. Cheatengine.org does not condone the illegal use of Cheat Engine. Online Events For Landscapers! With GIE+EXPO cancelled, virtual education and product launches are filling up the fall. Check out dates for Caterpillar, Exmark, NALP, and more.
LNK is a file extension used for a shortcut file that points to an executable file. It stands for LiNK file and acts as a direct link to an .exe file. This saves the users from navigating to the executable file, thus saving the time of the users. A Windows shortcut LNK file format is denoted by a curled arrow. In the below image, a LNK file of Mozilla Thunderbird is shown.
This article reflects LNK file structure and the properties associated with the file.
Overview of LNK File
The LNK file consists of the MAC times (times which specify when an event took place) of the target. This includes the timestamp of the target when it was last opened, when the LNK file was created, the access time and the modification time.
The other metadata related to LNK file structure are:
- The shell item list of the file's target.
- The size of the target file when it was accessed for the last time.
- The volume's serial number on which the target is stored.
- Name of the network volume share.
- Tracking information of the distributed link.
For Windows platform, the signature is 0x4C (4C 00 00 00) at offset 0.
Windows Shortcut LNK File Format
A LNK file consists of a number of sequence of structures that are in accordance with the ABNF rules.
SHELL_LINK = SHELL_LINK_HEADER [LINKTARGET_IDLIST] [LINKINFO]
[STRING_DATA] *EXTRA_DATA
The different sequences are described in detail as under: Zelda majora's mask 3d rom.
- SHELL_LINK_HEADER
The ShellLinkHeader structure comprises of information like identification, timestamps, and the flags that are used for signifying the presence of extra structures that include LinkTargetIDList, LinkInfo and StringData.
- LINKTARGET_IDLIST
The LinkTargetIDList structure of Windows shortcut LNK file format is used for specifying the target of the link to which it belongs. This structure is specified by the HasLinkTargetIDList bit that is present in the ShellLinkHeader. It is made up of two parts:
- IDListSize: this is of 2 bytes and signifies the size of the IDList field.
- IDList (variable): This structure that contains the item list of ID.
- LINKINFO
The LinkInfo structure is used for specifying information in case the link target is not found in its original location. This includes the info about the volume on which the target exe file was stored, the drive letter that was mapped with it, and a UNC path, which was present when the file was created.
- STRING_DATA
The StringData in LNK file structures are used for conveying information related to user interface and path identification. These structures are specified by the bits present in the ShellinkHeader.
- *EXTRA_DATA
The ExtraData comprises of structures that are used for conveying additional information about a [articular link target.
The concept of creating links for files and applications originally exists on Mac OS, LNK files are also used for Windows OS on a large level.
Most computer users will know that certain locations on your computer can store information about what you have done. Web browser history is one area that everyone knows can store computer and personal data. In Windows there are other less well known places that can record information you wouldn't necessarily expect. Some are used when looking for forensic data and determining the history of certain files. One of those areas is the humble Windows .LNK shortcut file.
On the face of it a simple shortcut is a tiny file that points to another file, such as an executable to launch a program from your desktop. Some details about the shortcut can be obtained by right clicking on it and clicking Properties. The Shortcut tab shows things like where the target file is located while the Details tab will show the date when the shortcut was created. But there's much more to a standard shortcut than you might think.
Actually, all .LNK shortcut files contain large amounts of data that identify the computer on which they were created as well as the computer they are currently on. For instance, inside the file data the network adapter MAC address and name of the original computer is stored along with any used network paths. Even the label, type and serial number of the drive it was created on is viewable. There is also much more data relating to times and dates to be found.
If you want to look at what data is being stored inside your shortcuts you will need a third party tool to decode that information as something like a hex editor will just show mostly gibberish. Zelda skyward sword wii rom. Here are 5 free tools for you to try out.
1. LnkanalyserIn terms of ease of use, Lnkanalyser is about as simple as it gets for a command line tool. The amount of information it displays over and above the Details tab in File Explorer is quite reasonable although some other tools listed here can show more. The only argument needed is to supply the path and filename of the .LNK file.
lnkanalyser -i [path]shortcut.lnk
Normal information for the paths and dates/times of the shortcut and the file it references are shown. In addition, you can view normally hidden details such as original timestamps, the name, serial number and type of drive the shortcut was created on, the name of the computer it was created on, network path/name and also the MAC address of the network adapter on the original computer.
Download lnkanalyser
2. Windows File Analyzer
As the name suggests, Windows File Analyzer is a dedicated tool for gathering all sorts of information about specific files on your computer. That includes thumbnails, Windows Prefetch files, Index.DAT files, Recycle Bin files and lnk shortcuts. The program is multi tabbed so you can have several analysis processes open at once. It's also a portable standalone executable.
Click the green/yellow button or the option in the File menu to analyze some shortcuts, browse for the folder and a list of all .LNK shortcuts will appear. The window will give standard details like created, written and accessed dates along with the more advanced data like hard disk name and serial, computer name and network card MAC address. Double click to get the same information in a box. Clicking to expand the entry can also give creation dates for all folders in the path to the file. Reports can be printed out but not directly saved to a file.
Download Windows File Analyzer
3. LECmd
Although LECmd is a command line tool it does require .NET Framework 4.6 to function, so everyone other than Windows 10 users will need to have installed it. The tool doesn't have too many arguments and you can view what's available by simply typing lecmd.exe into Command Prompt. To get data for a single .LNK file use -f or -d to process a directory of files.
lecmd -f [path]shortcut.lnk
lecmd -d path
LECmd has the ability to output the information direct to a CSV, XML, HTML or JSON file. Supply one or more of the arguments --[html/csv/xml/json] and the target directory to save each file. Add -q for a large folder full of shortcuts to skip outputting to the console and decrease processing time.
lecmd -d [path] --html C:html --xml C:xml --csv C:csv -q
The output is detailed and shows some quite advanced information such as path and file accessed and created dates, icon index and window information, hard drive type/serial/label, network share information, machine ID, MAC address and network adapter vendor.
Download LECmd
4. Link Parser
Link Parser is by forensics and security firm 4Discovery. It's a simple and completely portable tool to read a sizable amount of information from an lnk shortcut file. All the gathered information can be saved out to CSV file for future use. One issue we encountered while using Link Parser was the file open option didn't seem to work, so opening a folder will have to be used instead.
After opening a folder containing some .LNK shortcut files, you'll get quite a bit of information to read. All the current and original file creation dates and times are available along with useful data like original drive type, drive name, drive serial number, network name, relative path and computer name. Interestingly, Link Parser shows the current VolumeID, ObjectID and MAC address and also those values when the file was created. Note you will have to close and reopen the program to clear the data from the window.
Download Link Parser
5. LNK Parser
LNK Parser is another command line tool but it can also be used without manually typing commands. To do that double click the LNK Parser executable, drop a .LNK shortcut or folder onto the window. Optionally generate a report (supply the path if you selected to generate a report), answer a couple of simple questions and press Y or N if you want the output sent to the console window. You will also get the same steps by typing lnk_parser_cmd directly into Command Prompt without arguments.
The command line options are basically the same manual arguments for the wizard steps.
lnk_parser_cmd -o [save report path] -w (html report) -c (csv report) path[shortcut.lnk]
The amount of information is similar to other tools here and you get the more basic data as well as the hidden data. This includes source drive details, NetBIOS name, MAC address, folder path attributes with created and accessed dates/times and all folder ID data.
Download LNK Parser
6. LNK File Previewer
LNK File Previewer is a freeware version of the tool taken from the commercial Simple Carver Suite forensic software. The program is a bit old now dating from 2008 but seems to work fine. One minor issue is all files inside a folder are shown in the user interface and if they are not .LNK shortcuts will just show as an invalid file. LNK File Previewer is portable but comes in a RAR archive so you will need something like 7-Zip or WinRAR to unpack it.
To read the data for all shortcuts in a folder go to Process > Folder and find the target location. Before that optionally uncheck Recurse Sub-Folders at the bottom on the window to not go down layers looking for files. The amount of data shown is not as much as some tools but you still get useful details like MAC address, computer name, network path, hard disk type, serial and name, and a few useful dates. Clicking on an entry shows the basic details below. All the information for all processed files can be exported to CSV file.
.lnk Files On Mac
Download LNK File Previewer
Tip: If one of the command line tools provides you with better information but you don't really like using the Command Prompt every time to use it, there is a simple solution. Create a small batch file and drop the shortcut onto the .BAT file icon. As an added option open the results automatically in Notepad. For example, using Lnkanalyser you can create something like this:
Lnk Machinery Enterprise
@echo off
lnkanalyser -i %~1 >%temp%lnkfile.txt
Notepad %temp%lnkfile.txt
Windows Shortcut LNK File Format
A LNK file consists of a number of sequence of structures that are in accordance with the ABNF rules.
SHELL_LINK = SHELL_LINK_HEADER [LINKTARGET_IDLIST] [LINKINFO]
[STRING_DATA] *EXTRA_DATA
The different sequences are described in detail as under: Zelda majora's mask 3d rom.
- SHELL_LINK_HEADER
The ShellLinkHeader structure comprises of information like identification, timestamps, and the flags that are used for signifying the presence of extra structures that include LinkTargetIDList, LinkInfo and StringData.
- LINKTARGET_IDLIST
The LinkTargetIDList structure of Windows shortcut LNK file format is used for specifying the target of the link to which it belongs. This structure is specified by the HasLinkTargetIDList bit that is present in the ShellLinkHeader. It is made up of two parts:
- IDListSize: this is of 2 bytes and signifies the size of the IDList field.
- IDList (variable): This structure that contains the item list of ID.
- LINKINFO
The LinkInfo structure is used for specifying information in case the link target is not found in its original location. This includes the info about the volume on which the target exe file was stored, the drive letter that was mapped with it, and a UNC path, which was present when the file was created.
- STRING_DATA
The StringData in LNK file structures are used for conveying information related to user interface and path identification. These structures are specified by the bits present in the ShellinkHeader.
- *EXTRA_DATA
The ExtraData comprises of structures that are used for conveying additional information about a [articular link target.
The concept of creating links for files and applications originally exists on Mac OS, LNK files are also used for Windows OS on a large level.
Most computer users will know that certain locations on your computer can store information about what you have done. Web browser history is one area that everyone knows can store computer and personal data. In Windows there are other less well known places that can record information you wouldn't necessarily expect. Some are used when looking for forensic data and determining the history of certain files. One of those areas is the humble Windows .LNK shortcut file.
On the face of it a simple shortcut is a tiny file that points to another file, such as an executable to launch a program from your desktop. Some details about the shortcut can be obtained by right clicking on it and clicking Properties. The Shortcut tab shows things like where the target file is located while the Details tab will show the date when the shortcut was created. But there's much more to a standard shortcut than you might think.
Actually, all .LNK shortcut files contain large amounts of data that identify the computer on which they were created as well as the computer they are currently on. For instance, inside the file data the network adapter MAC address and name of the original computer is stored along with any used network paths. Even the label, type and serial number of the drive it was created on is viewable. There is also much more data relating to times and dates to be found.
If you want to look at what data is being stored inside your shortcuts you will need a third party tool to decode that information as something like a hex editor will just show mostly gibberish. Zelda skyward sword wii rom. Here are 5 free tools for you to try out.
1. LnkanalyserIn terms of ease of use, Lnkanalyser is about as simple as it gets for a command line tool. The amount of information it displays over and above the Details tab in File Explorer is quite reasonable although some other tools listed here can show more. The only argument needed is to supply the path and filename of the .LNK file.
lnkanalyser -i [path]shortcut.lnk
Normal information for the paths and dates/times of the shortcut and the file it references are shown. In addition, you can view normally hidden details such as original timestamps, the name, serial number and type of drive the shortcut was created on, the name of the computer it was created on, network path/name and also the MAC address of the network adapter on the original computer.
Download lnkanalyser
2. Windows File Analyzer
As the name suggests, Windows File Analyzer is a dedicated tool for gathering all sorts of information about specific files on your computer. That includes thumbnails, Windows Prefetch files, Index.DAT files, Recycle Bin files and lnk shortcuts. The program is multi tabbed so you can have several analysis processes open at once. It's also a portable standalone executable.
Click the green/yellow button or the option in the File menu to analyze some shortcuts, browse for the folder and a list of all .LNK shortcuts will appear. The window will give standard details like created, written and accessed dates along with the more advanced data like hard disk name and serial, computer name and network card MAC address. Double click to get the same information in a box. Clicking to expand the entry can also give creation dates for all folders in the path to the file. Reports can be printed out but not directly saved to a file.
Download Windows File Analyzer
3. LECmd
Although LECmd is a command line tool it does require .NET Framework 4.6 to function, so everyone other than Windows 10 users will need to have installed it. The tool doesn't have too many arguments and you can view what's available by simply typing lecmd.exe into Command Prompt. To get data for a single .LNK file use -f or -d to process a directory of files.
lecmd -f [path]shortcut.lnk
lecmd -d path
LECmd has the ability to output the information direct to a CSV, XML, HTML or JSON file. Supply one or more of the arguments --[html/csv/xml/json] and the target directory to save each file. Add -q for a large folder full of shortcuts to skip outputting to the console and decrease processing time.
lecmd -d [path] --html C:html --xml C:xml --csv C:csv -q
The output is detailed and shows some quite advanced information such as path and file accessed and created dates, icon index and window information, hard drive type/serial/label, network share information, machine ID, MAC address and network adapter vendor.
Download LECmd
4. Link Parser
Link Parser is by forensics and security firm 4Discovery. It's a simple and completely portable tool to read a sizable amount of information from an lnk shortcut file. All the gathered information can be saved out to CSV file for future use. One issue we encountered while using Link Parser was the file open option didn't seem to work, so opening a folder will have to be used instead.
After opening a folder containing some .LNK shortcut files, you'll get quite a bit of information to read. All the current and original file creation dates and times are available along with useful data like original drive type, drive name, drive serial number, network name, relative path and computer name. Interestingly, Link Parser shows the current VolumeID, ObjectID and MAC address and also those values when the file was created. Note you will have to close and reopen the program to clear the data from the window.
Download Link Parser
5. LNK Parser
LNK Parser is another command line tool but it can also be used without manually typing commands. To do that double click the LNK Parser executable, drop a .LNK shortcut or folder onto the window. Optionally generate a report (supply the path if you selected to generate a report), answer a couple of simple questions and press Y or N if you want the output sent to the console window. You will also get the same steps by typing lnk_parser_cmd directly into Command Prompt without arguments.
The command line options are basically the same manual arguments for the wizard steps.
lnk_parser_cmd -o [save report path] -w (html report) -c (csv report) path[shortcut.lnk]
The amount of information is similar to other tools here and you get the more basic data as well as the hidden data. This includes source drive details, NetBIOS name, MAC address, folder path attributes with created and accessed dates/times and all folder ID data.
Download LNK Parser
6. LNK File Previewer
LNK File Previewer is a freeware version of the tool taken from the commercial Simple Carver Suite forensic software. The program is a bit old now dating from 2008 but seems to work fine. One minor issue is all files inside a folder are shown in the user interface and if they are not .LNK shortcuts will just show as an invalid file. LNK File Previewer is portable but comes in a RAR archive so you will need something like 7-Zip or WinRAR to unpack it.
To read the data for all shortcuts in a folder go to Process > Folder and find the target location. Before that optionally uncheck Recurse Sub-Folders at the bottom on the window to not go down layers looking for files. The amount of data shown is not as much as some tools but you still get useful details like MAC address, computer name, network path, hard disk type, serial and name, and a few useful dates. Clicking on an entry shows the basic details below. All the information for all processed files can be exported to CSV file.
.lnk Files On Mac
Download LNK File Previewer
Tip: If one of the command line tools provides you with better information but you don't really like using the Command Prompt every time to use it, there is a simple solution. Create a small batch file and drop the shortcut onto the .BAT file icon. As an added option open the results automatically in Notepad. For example, using Lnkanalyser you can create something like this:
Lnk Machinery Enterprise
@echo off
lnkanalyser -i %~1 >%temp%lnkfile.txt
Notepad %temp%lnkfile.txt
Save the file as batchname.BAT and drop a shortcut onto it. The results will be output to lnkfile.txt in the TEMP folder and then Notepad will open the text file. You can of course send the results to a CSV or HTML file within the program instead of opening Notepad. Simple but effective.