analyzing-windows-lnk-files-for-artifacts
CommunityReconstruct file timelines from Windows LNKs.
AuthorYukiIto1999
Version1.0.0
Installs0
System Documentation
What problem does it solve?
Windows LNK files can be opaque and hinder forensic timeline reconstruction. This skill extracts critical artifacts such as target paths, timestamps, drive serials, volume labels, and machine identifiers from LNKs to enable accurate event sequencing.
Core Features & Use Cases
- Extracts target path, creation/modification/access times, volume information, machine IDs, and MAC addresses from Shell Link files.
- Analyzes Recent, Desktop, Startup, and Jump List items across fixed, removable, and network drives to support case timelines.
- Supports producing machine-readable payloads and human-readable reports for investigations and audits.
Quick Start
Start by analyzing all LNK files in the target directory to generate a structured artifact timeline.
Dependency Matrix
Required Modules
LnkParse3
Components
scriptsreferences
💻 Claude Code Installation
Recommended: Let Claude install automatically. Simply copy and paste the text below to Claude Code.
Please help me install this Skill: Name: analyzing-windows-lnk-files-for-artifacts Download link: https://github.com/YukiIto1999/ctf-sleuth/archive/main.zip#analyzing-windows-lnk-files-for-artifacts Please download this .zip file, extract it, and install it in the .claude/skills/ directory.
Agent Skills Search Helper
Install a tiny helper to your Agent, search and equip skill from 471,000+ vetted skills library on demand.