Skip to content

Liblnk

The liblnk package contains a library and applications to read the Windows Explorer Shortcut (lnk) format.

Tools

The liblnk package contains the following tools:

  • lnkinfo, which shows information about LNK files.

Examples

Requesting the information in a LNK file:

lnkinfo Calculator.lnk

lnkinfo 20150617

Windows Shortcut information:
    Contains a link target identifier
    Contains a description string
    Contains a working directory string
    Contains an environment variables block

Link information:
    Creation time           : Aug 10, 2004 16:54:24.000000000 UTC
    Modification time       : Aug 04, 2004 14:00:00.000000000 UTC
    Access time         : Jun 26, 2006 10:36:41.703125000 UTC
    File size           : 114688 bytes
    File attribute flags        : 0x00000020
        Should be archived (FILE_ATTRIBUTE_ARCHIVE)
    Drive type          : Fixed (3)
    Drive serial number     : 0xc868f004
    Volume label            : System
    Local path          : C:\WINDOWS\system32\calc.exe
    Description         : @%SystemRoot%\system32\shell32.dll,-22531
    Working directory       : C:\WINDOWS\system32
    Environment variables location  : %SystemRoot%\system32\calc.exe

Link target identifier:
    Shell item list
        Number of items     : 5

    Shell item: 1
        Item type       : Root folder
        Class type indicator    : 0x1f (Root folder)
        Shell folder identifier : 20d04fe0-3aea-1069-a2d8-08002b30309d
        Shell folder name   : My Computer

    Shell item: 2
        Item type       : Volume
        Class type indicator    : 0x2f (Volume)
        Volume name     : C:\

    Shell item: 3
        Item type       : File entry
        Class type indicator    : 0x31 (File entry: Directory)
        Name            : WINDOWS
        Modification time   : Dec 17, 2006 20:55:44
        File attribute flags    : 0x00000010
            Is directory (FILE_ATTRIBUTE_DIRECTORY)
    Extension block: 1
        Signature       : 0xbeef0004 (File entry extension)
        Long name       : WINDOWS
        Creation time       : Feb 01, 2006 21:49:46
        Access time     : Dec 17, 2006 20:55:48

    Shell item: 4
        Item type       : File entry
        Class type indicator    : 0x31 (File entry: Directory)
        Name            : system32
        Modification time   : Nov 26, 2006 19:56:54
        File attribute flags    : 0x00000030
            Is directory (FILE_ATTRIBUTE_DIRECTORY)
            Should be archived (FILE_ATTRIBUTE_ARCHIVE)
    Extension block: 1
        Signature       : 0xbeef0004 (File entry extension)
        Long name       : system32
        Creation time       : Feb 01, 2006 21:49:46
        Access time     : Dec 17, 2006 20:49:46

    Shell item: 5
        Item type       : File entry
        Class type indicator    : 0x32 (File entry: File)
        Name            : calc.exe
        Modification time   : Aug 04, 2004 14:00:00
        File attribute flags    : 0x00000020
            Should be archived (FILE_ATTRIBUTE_ARCHIVE)
    Extension block: 1
        Signature       : 0xbeef0004 (File entry extension)
        Long name       : calc.exe
        Creation time       : Aug 10, 2004 16:54:24
        Access time     : Jun 26, 2006 10:36:42

Distributed link tracking data:
        Machine identifier              : hostname
        Droid volume identifier         : aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
        Droid file identifier           : 00000000-1111-2222-3333-444444444444
        Birth droid volume identifier   : aaaaaaaa-bbbb-cccc-dddd-eeeeeeeeeeee
        Birth droid file identifier     : 00000000-1111-2222-3333-444444444444

History

Liblnk was created by Joachim Metz in 2009, while working for Hoffmann Investigations.

See Also