Форензика ярлыков Windows и Jump List

★ 8.4 · security

analyzing-lnk-file-and-jump-list-artifacts is a Claude Code skill that parses Windows LNK shortcut files and Jump List artifacts to reconstruct evidence of file access, program execution, and user activity — including cases where target files have already been deleted. The skill covers Shell Link Binary Format parsing of the 76-byte header (CreationTime, AccessTime, WriteTime, volume serial number, NetBIOS name, MAC address from TrackerDataBlock), LECmd and JLECmd commands by Eric Zimmerman with CSV and JSON output, and a Python script using pylnk3 or LnkParse3. It handles Automatic and Custom Destinations from the Recent folder and includes an AppID hash table for 12 common applications. Designed for digital forensics examiners, incident responders, and SOC analysts building file-access timelines or hunting threats mapped to MITRE ATT&CK techniques T1547.009, T1204.002, and T1059.001.