Windows Forensics Cookbook

How to do it...

Start LinkParser.exe, click on the folder icon, and choose a folder with the LNK files you want the tool to parse. In our case, it's C:\Users\{username}\AppData\Roaming\Microsoft\Windows\Recent - this folder contains recently used items; we exported it from a forensic image using FTK Imager. Link Parser has extracted data from 204 LNK files, as seen in the following figure:

Figure 7.20. Link Parser output

Link Parser extracts a huge amount of data from LNK files - more than 30 attributes, including Volume Serial Number, Volume Label, Volume ID, and more.

All parsed attributes can be easily exported to CSV. To do this, click ...