Each time you work with your system, windows stores traces of your activity in several
places. One of them is under lnk files, that are being created each time you access
to a document or application.
We have published a paper with complete information about how to deal with shortcut
files and how to extract information from them.
You can download here the published
This tool can also be used to extract full information from a disk image for forensic
(Windows executable + Source code)