user_parse_lnk_files
Parse Windows .lnk files to uncover recently accessed files, original locations, and access timestamps, aiding digital forensics investigations.
Instructions
Parse Windows shortcut (.lnk) files to determine target paths, access times, and volume information. Answers: What files did the user access recently? What were the original file locations?
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path to .lnk file, directory containing .lnk files, or user profile path | |
| limit | No | Maximum number of results | |
| recursive | No | Search recursively in subdirectories | |
| recent_only | No | Only search the user's Recent folder (requires user profile path) | |
| target_filter | No | Filter by target path (case-insensitive substring) | |
| extension_filter | No | Filter recent files by extension (e.g., '.exe', '.ps1') |