LNK Files and jump lists are two of the foundational artifacts relied upon by forensic examiners across many types of investigations. In particular, LNK files and jump lists can be helpful in cases involving USB device activity because they can be used to identify file activity on USB devices that have been attached to a system. USB Detective supports processing and correlating LNK files and jump lists with connected USB devices in order to provide a more complete picture of USB device activity on a system. This post describes some of the ways LNK files and jump lists can be leveraged in cases involving the use of USB devices.
Important Fields in LNK Files & Jump Lists
When a file is opened (i.e. double-clicked in Windows Explorer) from an attached USB device, a jump list record and/or LNK file is created on the system in a directory associated with the user account that opened the file. Since LNK files and jump list records rely largely on the same underlying structure, the type of information available from each is very similar. There are several fields within LNK files and jump list records that can useful depending on the type of investigation, but some of the highlights as it relates to USB device investigations include:
- Target File Path – this is the path to the file/folder referenced by the LNK file or jump list record. When opened from a USB device, this will be the path to the file/folder on the device (e.g. “E:\secrets.xlsx”).
- Target File Timestamps – these are the created/last modified/last accessed timestamps of the target file the last time it was opened.
- Volume Serial Number – this is the VSN of the file system in which the target file was stored the last time the target file was opened. If a file is opened from a connected USB device, this will be the VSN of the file system on the connected device.
An examiner can identify USB connection events and subsequent file activity on a connected device by correlating the volume serial number embedded in LNK files and jump lists with the volume serial number of a device that was connected to the system (as identified through other system artifacts). Although this type of analysis can be conducted manually, leveraging a tool such as USB Detective for the identification and correlation can greatly improve the speed and efficiency of analysis.
Leveraging LNK Files & Jump Lists using USB Detective
After processing a dataset that includes LNK files and jump lists, the reporting features of USB Detective can help reveal the power of combining the information available from LNK files and jump lists with the connection and disconnection events identified by USB Detective. For example, USB Detective device timeline reports combine the key attributes from LNK files and jump list records with connection and disconnection events, highlighting the actions related to a particular device.
The snippet below from a USB Detective device timeline report was created after three files were copied to and subsequently opened from a Lexar flash drive. This timeline clearly illustrates the Lexar device being connected to the system and a file called “database.xlsx” being created on the Lexar flash drive less than a minute later. Similarly, two other files (“secrets.docx” and “links.txt”) were created on the Lexar device within minutes of the device being connected to the system.
Through correlation of the volume serial number stored in LNK file and jump list metadata with the VSN of a device as determined through analysis of other system artifacts, an examiner can gain a better understanding of the file activity that took place on a connected USB device. USB Detective makes this process easier by parsing and correlating LNK file and jump list metadata with the myriad of connection data points gathered from artifacts across the operating system.
Interested in seeing what USB Detective can do for you? Request a free trial today!