Format
Microsoft Windows Shortcut
Summary
- Name
- Microsoft Windows Shortcut
- Identifiers
- PUID: x-fmt/428
- Description
- Microsoft Windows Shortcut also Microsoft Shell Link (LNK file) provided a way of launching an executable file (program, or some other digital file) outside of the host folder of that file on the host operating system. For example, Microsoft Operating Systems that had the concept of a 'Desktop' space (or 'folder') may hold a number of shortcuts to a user's most used application programs, e.g. Internet Explorer, and the user's Office Productivity Suite; or that user's favorite files, e.g. family photographs. The specification for Microsoft Windows Shortcut runs up to 48 pages long and consists of other standards required for parsing is successfully. The structure of the Microsoft Windows Shortcut file needs to be able to contain information about the location to use when it "executes" (its context), the command-line arguments specific to how an application will open, e.g. affecting user defaults, or the default behavior of an application. It may contain optional parameters such as hotkeys for opening a shortcut quickly using the keyboard. The format embeds metadata of interest to forensics researchers such as 'FileAttributes', 'CreationTime' and 'AccessTime' as well as other metadata such as `FileSize`, externalizing this information, separately from the link target (the target file, or program). This means the format may keep a record about other files even when the target file or application has been deleted.
- Note
- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/16cb4ca1-9339-4d0c-a68d-bf1d6cc0f943?redirectedfrom=MSDN
- File extensions
-
lnk - Source
- Digital Preservation Department / The National Archives
Internal signatures
Microsoft Windows Shortcut
- Note
- Reference to format: http://msdn.microsoft.com/en-us/library/dd871305(PROT.10).aspx. Byte values five to eight seem to need to be reversed (little-endian ordering) from the suggested ordering in the specification. Ambiguity in the specification means this ordering may or may not be expected.
Byte sequences
- Min Frag Length
- Absolute from BOF
- Offset
- 0
- Max offset
- None
- Byte Sequence
4C0000000114020000000000C000000000000046- Endianness
- Little-endian
Changelog
-
Updated in V118
- Release date
- 30 April 2024
Microsoft Windows Shortcut: Description created and documentation links added as part of PRONOM Research Week 2023. Submitted by Ross Spencer.