Forensic Analysis of Windows LNK Files to Reconstruct User Activity

The article focuses on forensic analysis of Windows LNK (shortcut) files to reconstruct user activity and identify executed files. It references the use of the tool LECmd for examining these shortcuts as part of digital forensic investigations. The content is part of a series titled 'Forensic Windows – Partie 7' and is published on the IT-Connect platform. No specific dates, CVEs, or quantitative impacts are mentioned in the provided text. The technical detail centers on leveraging LNK files for tracking file execution history in Windows environments.