The steps for LNK files analysis are given as follows:
- Once you have created a new case and added an evidence item, go to Process Evidence - Process... You will see the EnCase Processor Options window, as you can see in the following figure:
Figure 7.14. EnCase Processor Options
- As you can see, we have quite a lot of options here: you can Recover Folders, Find email, Find Internet artifacts, and so on. But, for now, let's go to the Modules folder. You can see its contents in the following figure:
Figure 7.15. Modules folder ...