Each time you work with your system, windows stores traces of your activity in several places. One of them is under lnk files, that are being created each time you access to a document or application.

We have published a paper with complete information about how to deal with shortcut files and how to extract information from them.



You can download here the published Spanish paper




This tool can also be used to extract full information from a disk image for forensic analysis.



Download (Windows executable + Source code)