Skip to main content
Service phase: Beta

This service is still in development. Give us your feedback or view this page on the current PRONOM service.

Format

Microsoft Windows Shortcut

Summary

Name
Microsoft Windows Shortcut
Identifiers
PUID: x-fmt/428
Description
Microsoft Windows Shortcut also Microsoft Shell Link (LNK file) provided a way of launching an executable file (program, or some other digital file) outside of the host folder of that file on the host operating system. For example, Microsoft Operating Systems that had the concept of a 'Desktop' space (or 'folder') may hold a number of shortcuts to a user's most used application programs, e.g. Internet Explorer, and the user's Office Productivity Suite; or that user's favorite files, e.g. family photographs. The specification for Microsoft Windows Shortcut runs up to 48 pages long and consists of other standards required for parsing is successfully. The structure of the Microsoft Windows Shortcut file needs to be able to contain information about the location to use when it "executes" (its context), the command-line arguments specific to how an application will open, e.g. affecting user defaults, or the default behavior of an application. It may contain optional parameters such as hotkeys for opening a shortcut quickly using the keyboard. The format embeds metadata of interest to forensics researchers such as 'FileAttributes', 'CreationTime' and 'AccessTime' as well as other metadata such as `FileSize`, externalizing this information, separately from the link target (the target file, or program). This means the format may keep a record about other files even when the target file or application has been deleted.
Note
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-shllink/16cb4ca1-9339-4d0c-a68d-bf1d6cc0f943?redirectedfrom=MSDN
File extensions
lnk
Source
Digital Preservation Department / The National Archives

Internal signatures

Microsoft Windows Shortcut

Note
Reference to format: http://msdn.microsoft.com/en-us/library/dd871305(PROT.10).aspx. Byte values five to eight seem to need to be reversed (little-endian ordering) from the suggested ordering in the specification. Ambiguity in the specification means this ordering may or may not be expected.

Byte sequences

Min Frag Length
Absolute from BOF
Offset
0
Max offset
None
Byte Sequence
4C0000000114020000000000C000000000000046
Endianness
Little-endian

Changelog

  • Updated in V118

    Release date
    30 April 2024

    Microsoft Windows Shortcut: Description created and documentation links added as part of PRONOM Research Week 2023. Submitted by Ross Spencer.