LNKFilesAndJumpLists.tkape

Description: LNK Files and jump lists
Author: Eric Zimmerman, Andrew Rathbun, Yogesh Khatri
Version: 1.3
Id: 2e354bdc-e418-438e-8439-c21c83c64e90
RecreateDirectories: true
Targets:
    -
        Name: LNK Files from Recent
        Category: LNKFiles
        Path: C:\Users\%user%\AppData\Roaming\Microsoft\Windows\Recent\
        Recursive: true
        Comment: Also includes automatic and custom jumplist directories
    -
        Name: LNK Files from Microsoft Office Recent
        Category: LNKFiles
        Path: C:\Users\%user%\AppData\Roaming\Microsoft\Office\Recent\
        Recursive: true
    -
        Name: Start Menu LNK Files
        Category: LNKFiles
        Path: C:\Users\%user%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
        FileMask: '*.LNK'
    -
        Name: LNK Files from Recent (XP)
        Category: LNKFiles
        Path: C:\Documents and Settings\%user%\Recent\
        Recursive: true
    -
        Name: Desktop LNK Files XP
        Category: LNKFiles
        Path: C:\Documents and Settings\%user%\Desktop\
        FileMask: '*.LNK'
    -
        Name: Desktop LNK Files
        Category: LNKFiles
        Path: C:\Users\%user%\Desktop\
        FileMask: '*.LNK'
    -
        Name: Restore point LNK Files XP
        Category: LNKFiles
        Path: C:\System Volume Information\_restore*\RP*\
        FileMask: '*.LNK'
    -
        Name: LNK Files from C:\ProgramData
        Category: LNKFiles
        Path: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\
        FileMask: '*.LNK'

# Documentation
# https://www.sans.org/security-resources/posters/windows-forensic-analysis/170/download
# https://www.youtube.com/watch?v=g1zYCvzhBS4
# https://belkasoft.com/forensic-analysis-of-lnk-files
# http://windowsir.blogspot.com/2017/05/use-of-lnk-filesagain.html
# https://dfir.pubpub.org/pub/wfuxlu9v
# https://www.forensafe.com/blogs/jumplist.html
# https://www.forensafe.com/blogs/lnkfile.html
# https://www.thedfirspot.com/post/a-lnk-to-the-past-utilizing-lnk-files-for-your-investigations