user_parse_lnk_files
Parse Windows shortcut files to reveal recently accessed files, their original locations, and timestamps for forensic analysis.
Instructions
Parse Windows shortcut (.lnk) files to determine target paths, access times, and volume information. Answers: What files did the user access recently? What were the original file locations?
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to .lnk file, directory containing .lnk files, or user profile path | |
| recursive | No | Search recursively in subdirectories | |
| target_filter | No | Filter by target path (case-insensitive substring) | |
| recent_only | No | Only search the user's Recent folder (requires user profile path) | |
| extension_filter | No | Filter recent files by extension (e.g., '.exe', '.ps1') | |
| limit | No | Maximum number of results |