How to View the Link Files
Posted by on 01 July 2019 05:21 AM

Electronic Evidence Examiner allows you to detect the link files in the filesystem evidence and view them in the Hex and Text viewers.

The link files are the shortcuts that link to an application or file, and contain the type, location, filename, as well as the program that opens the file or runs the application.

To view the link files content:

1. Add filesystem evidence to a new or existing case (for more information on adding different types of evidence, please see the corresponding How to Investigate… topic).

2. In the Case Content pane (to the left), navigate to the folder containing the link files; or use the Advanced Search option to find the link files by their extension (.lnk).

NOTE: The default location of the link files is the following: C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent

3. Select the required link file.

4. In the File Viewers group, select the Hex View tab or the Text View tab to view the link file in the corresponding format.

(0 vote(s))
Not helpful

Comments (0)