information about Microsoft Windows LNK files
lnk_info shows information about LNK files.
creation_date: <string> date in ISO8601 format.access_date: <string> date in ISO8601 format.modification_date: <string> date in ISO8601 format.link_flags: <list of strings> basic properties of the LNK file.target_path: <string> (optional) target path from Link Target Identifier fields.icon_location: <string> (optional) path to the icon location.mac_address: <string> (optional) network MAC address.mac_vendor_name: <string> (optional) network vendor name from MAC address.machine_id: <string> (optional) computer name.working_directory: <string> (optional) target working directory.relative_path: <string> (optional) target file relative path.command_line_arguments: <string> (optional).volume_serial_number: <string> (optional) disk volume serial number.volume_label: <string> (optional) disk volume label.local_path: <string> (optional).common_path: <string> (optional).network_share_name: <string> (optional).extra_data:dlt_properties: <dictionary> dlt properties of the LNK file.birth_droid_file_id: <string>,droid_file_id: <string>,birth_droid_volume_id: <string>,droid_volume_id: <string>
link_target_id_list: <list of dictionaries> Every entry contains the following fields:clsid: <string>,item_type: <integer>,item_type_str: <string>
header: <dictionary>.show_window: <integer>,show_window_str: <string>,hot_key: <string>,file_size: <integer>
{
"data": {
...
"attributes" : {
...
"lnkcheck": {
"creation_date": "<string:ISO8601>",
"access_date": "<string:ISO8601>",
"modification_date": "<string:ISO8601>",
"link_flags": ["<string>",...],
"target_path": "<string>",
"icon_location": "<string>",
"mac_address": "<string>",
"mac_vendor_name": "<string>",
"machine_id": "<string>",
"working_directory": "<string>",
"relative_path": "<string>",
"command_line_arguments": "<string>",
"volume_serial_number": "<string>",
"volume_label": "<string>",
"local_path": "<string>",
"common_path": "<string>",
"network_share_name": "<string>"
"extra_data": {
"dlt_properties": {
"birth_droid_file_id": "<string>",
"droid_file_id": "<string>",
"birth_droid_volume_id": "<string>",
"droid_volume_id": "<string>"
}
}
"shell_item": {
"clsid": "<string>",
"item_type": "<integer>",
"item_type_str":"<string>"
}
"header": {
"show_window": "<integer>",
"show_window_str": "<string>",
"hot_key": "<string>",
"file_size": "<integer>"
},
}
}
}
{
"data": {
"attributes": {
"lnkcheck": {
"common_path": "C:\\Program Files\\Greenrain\\Submission\\unins000.exe",
"machine_id": "445817",
"modification_date": "2016-07-27T18:25:43.570251Z",
"link_flags": [
"HasLinkInfo",
"HasRelativePath",
"IsUnicode",
"HasWorkingDir",
"HasExprString",
"EnableTargetMetadata"
],
"vhash": "1234567890",
"network_share_name": "\\\\USER\\HTMLQA",
"creation_date": "2016-06-28T21:49:46.108805Z",
"header": {
"show_window": 1,
"show_window_str": "SW_NORMAL",
"hot_key": "(0+0)",
"file_size": 6486
},
"relative_path": "..\\..\\..\\..\\..\\..\\Program Files\\Greenrain\\Submission\\unins000.exe",
"local_path": "C:\\Program Files\\Greenrain\\Submission\\unins000.exe",
"working_directory": "C:\\Program Files\\Greenrain\\Submission",
"mac_address": "00:50:56:a0:09:e3",
"access_date": "2016-06-28T21:49:46.108805Z",
"extra_data": {
"dlt_properties": {
"birth_droid_file_id": "33a6be73-453c-11e6-9444-00155d0b8406",
"droid_file_id": "33a6be73-453c-11e6-9444-00155d0b8406",
"birth_droid_volume_id": "85cdf8e2-5f07-4f3a-a953-67709a1e8150",
"droid_volume_id": "85cdf8e2-5f07-4f3a-a953-67709a1e8150"
}
},
"mac_vendor_name": "VMware, Inc."
}
}
}
}