Where are Link Files stored?

Link files, within a Windows Operating system can, in theory stored anywhere, depending on the users choices.

However the default locations for Link Files are:

C:\Documents and Settings\[username]\recent

C\Documents and Settings\username]\Application Data\Microsoft\Office\Recent

Link files are also backed up in the System Restore folders, which is an excellent source of information.

C\System Volume Information\_restore{XXXXXXXXXXXXXXX\snapshot

However, these dates should be treated with caution, due to the nature of the lnk files. Not only are the names of the files changes during the back up, but research suggests that so are some dates (don’t take this information to court, but test for yourself).

Link files can also be found in other folders, e.g program files, the desktop, and the starup folder. The best way to locate all of them is to apply a filter with EnCase, FTK, or your preferred forensics tool


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: