Windows Forensics Cookbook

How to do it...

The steps for LNK files analysis with LECmd:

1. As we have already said, LECmd can process both single files and folders. If you want to extract information from a single file, use -f switch; if your target is a directory, use -d switch. If you are interested only in LNK files pointing to removable drives, you can use -r switch. The other available options can be seen in the following figure:

Figure 7.18. LECmd options

2. If you want to run LECmd against a file or folder on a forensic image, first you should mount it. Thankfully, you already know how to do this. In our case, the main partition is mounted under N:\. Let's use LECmd ...