The best feature you never knew existed - Export LNK Contents & Export LNK metadata in FTK

Export LNK Contents & Export LNK metadata in FTK

Bonjour Reader!,
I know I have large gaps in my blog posts, its not for a lack of ideas but it is for a lack of time. With the economic recovery in full swing in the legal world we are very busy.

However, I still need to finish my new book and start getting back to blogging more regularly so please feel free to harass me on twitter @hecfblog if I don't write a post once a week.

In this short post I am going to point out a feature in FTK that has existed since 3.3 atleast that I never knew existed. The feature is called 'export lnk contents' in ftk 3.3 and 'export LNK metdata' in ftk 4.0 and it may be the one feature that I wish existed in FTK for the last 8 years of using it. When I've mentioned what this feature is and what it does to fellow examiners each of them has said the same two things:

1. "Woh! This going to save me so much time!"
2. "Why didn't they tell everyone this was here?!"

So in relation to point number 2, let me do that for them.

HEY EVERYONE, FTK will now export out all of the metadata of a lnk file and the contents of the parsed lnks to a file (from atleast 3.2-4.0)!

It can do this with one, some or all LNK files just highlight them, right click a lnk and the context menu will show the option! Suddenly all the manual copy and pasting into a spreadsheet or running other tools (like tzworks lslnk) are no longer necessary. This is especially great when it comes to carved LNK files that may not actually be valid and break many third party tools when they try to parse them.

What all does it export you say?
Keep reading!

Surely there is no way they snuck in a feature everyone wanted and didn't tell anyone?
I sure didn't see it!

It must be missing something right?
Not that I can see! It exports out into a tab seperated file:

* Shortcut File - Name of the LNK file

* Local Path - The path to the file the LNK file is pointing to

* Volume Type - The type of volume (Fixed, Removable, CDROM) of the volume being accessed

* Volume Label - The volume label for the volume being accessed

* Volume Serial Number - The VSN of the volume being accessed

* Network Path - If this was done over the network, the full UNC path to the file

* Short Name - The 8.3 name of the file

* File Size - Size of the file in bytes

* Creation time (UTC) - When the file the LNK file is pointing to was created

* Last write time (UTC) - When the file the LNK file is pointing to was modified

* Last access time (UTC) - When the file the LNK file is pointing to was accessed

* Directory - If file the LNK file is ponting to is a directory

* Compressed - If file the LNK file is ponting to is compressed

* Encrypted - If file the LNK file is ponting to is encrypted

* Read-only - If file the LNK file is ponting to is marked read only

* Hidden - If file the LNK file is ponting to is marked hidden

* system - If file the LNK file is ponting to is marked as a system file

* Archive - If file the LNK file is ponting to is marked as to be archived

* Sparse - If file the LNK file is ponting to is 'sparse'

* Offline - If file the LNK file is ponting to is offline

* Temporary - If file the LNK file is ponting to is a ntfs temporary file

* Reparse point - If file the LNK file is ponting to is extended directory information

* Relative Path - The relative path to the LNK file

* Program arguments - Any arguements stored for the execution of the program

* Working directory - Where the executable will default for reads/writes without a path

* Icon - What icon is associated with the executable if any

* Comment - This is an outlook feature, not sure why its included

* NetBIOS name - The network names of the system the LNK file was accessing

* MAC address - The MAC of the system the LNK file was accessing

So the next time you are working a case in FTK and you want to know what was being accessed from external drives (and you are checking shell bags and other artifacts seperately of course) then make a filter for all file with the extension 'LNK' and right click on one and export all of them to TSV. Import that TSV into excel, sort by Local Path and your done! This may be one the biggest time savers I've found in FTK in years and I now use it on every case.

Have you found a feature you love that everyone seems to miss? Leave it in the comments below.


4 comments :

  1. Hi David - great post - I just gave you a hat tip for highlighting the "export LNK metadata" on a blog post (http://bit.ly/xIGkic - FTK 4 - Evolution, Features and launch event (translated).

    Best Regards,

    ReplyDelete
  2. Hi David, thanks for reminding me of that. Due to the nature of the stuff that I get involved in (internal corporate, IP theft is an issue) it makes a lot of sense to open in FTK in Field Mode and do this first. I also use Harlan's lslnk module, Windows File Analyzer, and Sanderson's LinkAlyzer but in most cases this will save me time.

    ReplyDelete
  3. David, Have you done any testing to determine on NTFS thumb drive to see if the "birth volumeID" is also interpreted correctly? I've seen many link file interpreters, but not many of them even consider listing the originating volume. That ID is in the $Volume file and could not be verified unless you have that file as well with your link files. Object IDs can be viewed with "fsutil objectid query fileName".

    I copied Microsoft notes on this important feature that might be relevant in investigations.
    "You can use the Distributed Link Tracking Server service and the Distributed Link Tracking Client service to track links to files on NTFS-formatted partitions. Distributed Link Tracking tracks links in scenarios where the link is made to a file on an NTFS volume, such as shell shortcuts and OLE links. If that file is renamed, moved to another volume on the same computer, moved to another computer, or moved in other similar scenarios, Windows uses Distributed Link Tracking to find the file. "

    ReplyDelete
  4. Hi Zoltan,
    I'll have to double check to see if this value is being extracted through FTK, thanks for pointing that out!

    ReplyDelete