LNKFilesAndJumpLists

Windowsv1.3

Author: Eric Zimmerman, Andrew Rathbun, Yogesh Khatri

description

LNK Files and jump lists

paths

8 paths

LNKFilesLNK Files from Recent

C:\Users\%user%\AppData\Roaming\Microsoft\Windows\Recent\

Also includes automatic and custom jumplist directories

LNKFilesLNK Files from Microsoft Office Recent

C:\Users\%user%\AppData\Roaming\Microsoft\Office\Recent\

LNKFilesStart Menu LNK Files

C:\Users\%user%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs*.LNK

LNKFilesLNK Files from Recent (XP)

C:\Documents and Settings\%user%\Recent\

LNKFilesDesktop LNK Files XP

C:\Documents and Settings\%user%\Desktop\*.LNK

LNKFilesDesktop LNK Files

C:\Users\%user%\Desktop\*.LNK

LNKFilesRestore point LNK Files XP

C:\System Volume Information\_restore*\RP*\*.LNK

LNKFilesLNK Files from C:\ProgramData

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\*.LNK

› paths use Windows environment syntax

collection commands

source:

destination:

# PowerShell Artifact Collection Script
# Target: LNKFilesAndJumpLists
# Run as Administrator

#Requires -RunAsAdministrator

$ErrorActionPreference = "SilentlyContinue"
$DestBase = "D:\Evidence"

# Function to handle directory creation and copying
function Collect-Artifact {
    param (
        [string]$SourcePath,
        [string]$FolderName
    )
    $FullDest = Join-Path -Path $DestBase -ChildPath $FolderName
    if (-not (Test-Path -Path $FullDest)) {
        New-Item -ItemType Directory -Path $FullDest -Force | Out-Null
    }
    Copy-Item -Path $SourcePath -Destination $FullDest -Recurse -Force
}

# 1. LNK Files from Recent
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Windows\Recent\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "LNK_Files_from_Recent"

# 2. LNK Files from Microsoft Office Recent
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Office\Recent\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "LNK_Files_from_Microsoft_Office_Recent"

# 3. Start Menu LNK Files
$UserPath = Join-Path $env:USERPROFILE "AppData\Roaming\Microsoft\Windows\Start Menu\Programs"
Collect-Artifact -SourcePath "$UserPath\*.LNK" -FolderName "Start_Menu_LNK_Files"

# 4. LNK Files from Recent (XP)
$UserPath = Join-Path $env:USERPROFILE "Recent\"
Collect-Artifact -SourcePath "$UserPath\*" -FolderName "LNK_Files_from_Recent__XP_"

# 5. Desktop LNK Files XP
$UserPath = Join-Path $env:USERPROFILE "Desktop\"
Collect-Artifact -SourcePath "$UserPath\*.LNK" -FolderName "Desktop_LNK_Files_XP"

# 6. Desktop LNK Files
$UserPath = Join-Path $env:USERPROFILE "Desktop\"
Collect-Artifact -SourcePath "$UserPath\*.LNK" -FolderName "Desktop_LNK_Files"

# 7. Restore point LNK Files XP
Collect-Artifact -SourcePath "C:\System Volume Information\_restore*\RP*\\*.LNK" -FolderName "Restore_point_LNK_Files_XP"

# 8. LNK Files from C:\ProgramData
Collect-Artifact -SourcePath "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\\*.LNK" -FolderName "LNK_Files_from_C__ProgramData"

Write-Host "Collection complete!" -ForegroundColor Green

› Save as .ps1 and run as Administrator. Use: powershell -ExecutionPolicy Bypass -File script.ps1