tag:blogger.com,1999:blog-9518042.post2818325111614280236..comments2024-03-19T07:46:20.437-05:00Comments on Windows Incident Response: There Are Four Lights: LNK Parsing toolsUnknownnoreply@blogger.comBlogger4125tag:blogger.com,1999:blog-9518042.post-32196680539037047012013-06-18T09:56:21.920-05:002013-06-18T09:56:21.920-05:00Eric and Jimmy,
I created a folder named "L...Eric and Jimmy, <br /><br />I created a folder named "LNK", and uploaded camera.txt to it.<br /><br />Solal,<br /><br /><i>Why not test the DFF 'lnk' module ? </i><br /><br />As I stated in the post, I queried the forum as to which tools were currently being used to parse LNK files, and I tried to find those mentioned. No one mentioned the module.H. Carveyhttps://www.blogger.com/profile/08966595734678290320noreply@blogger.comtag:blogger.com,1999:blog-9518042.post-32913932100039627222013-06-18T09:33:36.431-05:002013-06-18T09:33:36.431-05:00Hello Keydett,
Why not test the DFF 'lnk'...Hello Keydett,<br /><br />Why not test the DFF 'lnk' module ? <br />You can simply load the lnk by choosing 'file/Open Evidence',<br />then 'directory' on the list menu (the default is file) then click on the<br />green cross to add the directory where the lnk file is. (If you choose 'file' <br />the lnk will be resolved to the pointed file, this is a feature not a bug ;) <br />Once done simply double-click on the loaded lnk file in the Browser (under 'Logical Files') and all the metadata will appear on the right-pane.<br /><br />I would like to know what you think about it,<br />and also as the project is open-source and has a tracker<br />you can simply post a request on it if you think the module result is not <br />complete enough or if you find some bug / wrong result, this kind of contribution will allow us to develop a better tools.<br /><br />Solal.Anonymoushttps://www.blogger.com/profile/10715636440008749024noreply@blogger.comtag:blogger.com,1999:blog-9518042.post-12475189161165188822013-06-18T09:32:25.294-05:002013-06-18T09:32:25.294-05:00Hralan, can you post your test file, perhaps in th...Hralan, can you post your test file, perhaps in the Files section of the forum?JimmyWegnoreply@blogger.comtag:blogger.com,1999:blog-9518042.post-3904846040374324162013-06-18T09:29:15.110-05:002013-06-18T09:29:15.110-05:00Can i get a copy of the lnk files you used? id lik...Can i get a copy of the lnk files you used? id like to test X-Ways so it can be added to the comparisonAnonymoushttps://www.blogger.com/profile/09622092264218597848noreply@blogger.com