Protected: Windows Artifacts

0 of 22 lessons complete (0%)

Shortcut Files

Module 2 – Shortcut Files

Module 2 – Shortcut Files

Shortcut files might be:
  • User created
    • Such as an App or file shortcut on the Desktop for fast access to the item
  • System created
    • In the background without knowledge of user
User created shortcut files
  • Can be found in any location selected by the user
    • For example – on the Desktop for quick access to the file, directory or application
  • A Shortcut file is indicated by an ↗ (arrow) on the left down corner of the file icon
Target File information within a link file includes
  • Original path
  • Timestamps (MAC)
  • Size
  • Name
  • Attributes(hidden, read only, archieve, etc
Practical:
  1. Place the provided “Important.pdf” file to the “Documents” folder
    • a.) Target file location: Users/User/Documents/Important.pdf
  2. Create a shortcut file
    • a.) Right click on the file and Select “Create shortcut”
    • The “Important – Shortcut” file will appear in the directory.
      • Move it to the Desktop.
  3. Investigate the shortcut file properties
    • a.) Shortcut file location: Users/User/Desktop/Important – Shortcut
    • b.) Right click – “Properties”
    • c.) Investigate the shortcut file properties

Shortcut file creation

Shortcut files :
  • System Created (without user knowledge)
  • User Created
  • Unique and specific to each user
  • LNK files can be removed by user!
Location for the Shortcut files:
  • Windows XP:
    • C:\Documents and Settings\USER\\Recent
  • Windows 7/8/10/11:
    • C:\USER\\AppData\Roaming\Microsoft\Windows\Recent
  • Microsoft Office documents:
    • C:\USER\\AppData\Roaming\Microsoft\Office\Recent\
  • AppData folders:
    • Local: Local Settings (maps to local settings in XP)
    • LocalLow: low integrity process can store data, like Internet Explorer running in protective mode (not in XP)
    • Roaming: Application Data
Practical
  • Navigate to the Recent Items folder and analyze the contents: C:\Users\\AppData\Roaming\Microsoft\Windows\Recent
  • Right click on the file ”Important.pdf”
  • Click “Properties” from the menu
WA_module-2-images
Scroll to Top