Sustainability of Digital Formats: Planning for Library of Congress Collections

A Microsoft Windows Shortcut File (LNK) is a file format designed to link to various types of information such as files, network shares, and search results. It employs the .lnk file extension and serves as a reference to a system location known as the link target. While the format supports Object Linking and Embedding (OLE) for object access, it is predominantly utilized as “shortcuts” to applications and file locations on the file system.

The LNK file format comprises five structures, with some being mandatory and others optional:

• 1. SHELL_LINK_HEADER: Mandatory structure containing essential information and flags for the rest of the file's structures.
• 2. LINKTARGET_IDLIST: Specifies the link target using the ItemID structure.
• 3. LINKINFO: Holds details about the location of the link target, including volume, serial number, and local paths.
• 4. STRING_DATA: Contains information about paths and interfaces for the link target. These structures are optional and are present only if the appropriate flag in LinkFlags (in ShellLinkHeader) is set.
• 5. EXTRA_DATA: Optional structures providing additional information about the link target.

Additionally, each LNK file has three dates associated with the target file: Created, Modified, and Accessed.

In forensic analysis, timestamps related to LNK files are not precisely specific due to updates occurring at various times and for different reasons. The only assurance regarding file timestamps is that the file time is accurately reflected when the handle responsible for the change is closed.

LNK files appear on the Windows graphical user interface (GUI), appearing on the Desktop, folders, and more. They appear without a file extension and with an illustration of an arrow in the bottom left corner (see Belkasoft’s Forensic Analysis of LNK Files for a visual example).

These files play a role in the "My Recent Documents" list in Windows XP and the "Recent Items" section in Windows Vista. Specific file locations include:

Windows XP:

• \Documents and Settings\UserName\Recent
• \Documents and Settings\UserName\Application Data\Microsoft\Office\Recent

Windows Vista:

• \Users\UserName\AppData\Roaming\Microsoft\Windows\Recent
• \Users\UserName\AppData\Roaming\Microsoft\Office\Recent

The specification notes that LNK files have some backwards compatibility. They can be used in Windows versions as early as Windows NT 3.1.

Fully disclosed, thoroughly documented.

LNK was first released in 1995 but was not disclosed until July 16, 2010. See: History for more details.

Official specification: [MS-SHLLINK]: Shell Link (.LNK) Binary File Format.

Versions 2.0 and newer of the specification are available online.

For older versions, not a lot of transparency because there wasn't an open specification.

For the files themselves, they do not indicate version. Comments welcome.

Security Concerns with LNK Files:

LNK files have been exploited for use in malware. Details to how LNK files are used in malware can be found in the articles "How LNK Files Are Abused by Threat Actors" and "Following the LNK Metadata Trail". Two noticeable instances of LNK usage in malware are:

• Raspberry Robin Malware: "Raspberry Robin" is a malware strain that utilizes LNK files for propagation. It is commonly introduced through infected removable drives, such as universal serial bus (USB) devices. The worm often disguises itself as a legitimate folder through a LNK file. This malware is part of a broader malware family, as highlighted in a warning from the Microsoft Security Blog.
• lnkbomb: "lnkbomb" is another example of malware specifically designed for testing security systems. It leverages LNK files as part of its testing strategy.

The LNK file format was introduced in 1995 with Windows 95. Although released in 1995 LNK was not disclosed or documented until 2010. In the fifteen year interval between release and disclosure some users reverse engineered the format and distributed unofficial documentation online.

Before Microsoft officially published information about LNK, researchers attempted to describe the format independently. Two notable unofficial versions of the specification are “Windows Shortcut File Format Specification,” by Joachim Metz, and "The Windows Shortcut File Format as Reverse-Engineered by Jesse Hager Document Version 1.0," by Jesse Hager.

The official LNK specification, versions 2.0 and above, are available online. Older versions are not accessible. The specification details changes made in each version. Notable modifications:

Version 7.0 and Version 6.0:

• Both versions note that the VistaAndAboveIDListDataBlock structure is not supported on Windows NT, Windows 2000, Windows XP, or Windows Server 2003.

Version 5.0 (changes from v4):

• Clarified details about TrackerDataBlock and ConsoleDataBlock that may differ in earlier versions.
• Added Windows Server 2019 to the list of applicable products.
• Updated the VolumeLabelOffsetUnicode field description for VolumeID to indicate that it MUST NOT be present under certain circumstances.
• Added the value 0x00 to the LowByte and HighByte tables for HotKeyFlags.

Version 4.0 (changes from v3):

• Added Windows Server operating system to the list of applicable products.

Version 3.0 (changes from v2):

• Added Windows 10 to the applicability list.

Version 2.0 (changes from v1.2):

• Minor clarifications for LinkFlags and LinkInfo fields.
• Changed the name of the CommonBasePath field to CommonPathSuffix, a significant change among the minor updates.