190 likes | 330 Views
Link Files. . lnk Jesse Hager “The Windows Shortcut File Format” http://code.google.com/p/8bits/downloads/detail?name=The_Windows_Shortcut_File_Format.pdf&can=2&q=. Shortcut Files. File extension .lnk Created whenever an off board file is opened Contain MAC times (UTC) Path name
E N D
Link Files .lnk Jesse Hager “The Windows Shortcut File Format” http://code.google.com/p/8bits/downloads/detail?name=The_Windows_Shortcut_File_Format.pdf&can=2&q=
Shortcut Files • File extension .lnk • Created whenever an off board file is opened • Contain MAC times (UTC) • Path name • Volume type and S/N
Link File Creation • Activation of a file from Windows Explorer • When a file is opened from some applications • Particularly Microsoft Office files
Clear “Recent Items” WinXP • Properties of the Start Menu • Select “Clear List”
.lnk Files • They appear as “My Recent Documents” • Form the basis of Jump Lists • Win XP • C:\Documents and Settings\User Name\Recent • Vista & Win7 • \Users\user name\AppData\Roaming\Microsoft\Windows\Recent • \Users\user name\AppData\Roaming\Microsoft\Office\Recent • \Users\user name\Links\
Clear “Recent Items” Win 7 To clear “Recent Item List” Right click on Recent Items and select clear
Registry Data Shows SettingsWinXP Start_ShowRecentDocs=0 Do not list Recent Documents Start_ShowRecentDocs=2 List Recent Documents
Registry Data Shows SettingsWin7 Start_ShowRecentDocs=0 & Start_Tracks=0 Do not list Recent Documents Start_ShowRecentDocs=2 & Start_Tracks=0 List Recent Documents
Basic File Structure • File header • Shell item ID list Item 1 Item 2 etc. • File location info local path Network path • Description string • Relative path string • Working directory string • Command line string • Icon filename string • Extra stuff
Shell Item ID List • Present only if bit 0 is set in flags • How to get from the desktop to the contents of the link file
Cierra’s pics 2.nws.lnk Magic Number File Length 0x43A00 = 276992