lnkanalyser v1.0.1
Lnk Metadata
Path: C:\Users\82103\Desktop[BOBDF11]강현수중심극한과큰수.docx - 바로 가기.lnk
Flags:
Attributes: Archive
Show Command: SWSHOWNORMAL
Name:
Relative Path: .[BOB_DF11]??????????.docx
Working Path: C:\Users\82103\Desktop
Arguments:
Icon Location:
Target Metadata
Created Timestamp: 2022-08-04 오전 2:03:05
Accessed Timestamp: 2022-09-14 오전 2:38:34
Written Timestamp: 2022-08-04 오후 1:38:20
File Size: 35026
Icon Index: 0
Volume Id
Drive Type: DRIVE_FIXED
Serial No: D071202B
Name:
TrackerDataBlock
MachineId: k0874
NewVolumeId: A8AFD3DF79234E45933D79122810AC8B
NewObjectId: C15CDD04FC12ED11A039C403A89440ED
NewObjectId Timestamp: 2022-08-03 오전 7:15:14
NewObjectId Sequence Number: 8249
NewObjectId MAC Address: C4:03:A8:94:40:ED
BirthVolumeId: A8AFD3DF79234E45933D79122810AC8B
BirthObjectId: C15CDD04FC12ED11A039C403A89440ED
BirthObjectId Timestamp: 2022-08-03 오전 7:15:14
BirthObjectId Sequence Number: 8249
BirthObjectId MAC Address: C4:03:A8:94:40:ED
CommonNetworkRelativeLink
Device Name:
Net Name:
Network Provider Type:
- lnk analyzer
LECmd version 1.5.0.0
Author: Eric Zimmerman (saericzimmerman@gmail.com)
https://github.com/EricZimmerman/LECmd
Command line: -f C:\Users\82103\Desktop[BOBDF11]강현수중심극한과큰수.docx - 바로 가기.lnk
Warning: Administrator privileges not found!
Processing C:\Users\82103\Desktop[BOBDF11]강현수중심극한과큰수.docx - 바로 가기.lnk
Source file: C:\Users\82103\Desktop[BOBDF11]강현수중심극한과큰수.docx - 바로 가기.lnk
Source created: 2022-09-14 02:38:34
Source modified: 2022-09-14 02:38:34
Source accessed: 2022-09-14 02:41:55
--- Header ---
Target created: 2022-08-04 02:03:05
Target modified: 2022-08-04 13:38:20
Target accessed: 2022-09-14 02:38:34
File size: 35,026
Flags: HasTargetIdList, HasLinkInfo, HasRelativePath, HasWorkingDir, IsUnicode, EnableTargetMetadata
File attributes: FileAttributeArchive
Icon index: 0
Show window: SwNormal (Activates and displays the window. The window is restored to its original size and position if the window is minimized or maximized.)
Relative Path: .[BOBDF11]강현수중심극한과큰수.docx
Working Directory: C:\Users\82103\Desktop
--- Link information ---
Flags: VolumeIdAndLocalBasePath
Volume information
Drive type: Fixed storage media (Hard drive)
Serial number: D071202B
Label: (No label)
Local path: C:\Users\82103\Desktop[BOB_DF11]°Co¼o_Aß½E±ØCN°uA≪¼o.docx
--- Target ID information (Format: Type ==> Value) ---
Absolute path:
-File ==> (None)
Short name: _BOB_D~1.DOC
Modified: 2022-08-04 13:38:22
Extension block count: 1
--------- Block 0 (Beef0004) ---------
Long name:
Created: 2022-08-04 02:03:06
Last access: 2022-09-08 04:24:02
MFT entry/sequence #: 465600/42 (0x71AC0/0x2A)--- End Target ID information ---
--- Extra blocks information ---
Tracker database block
Machine ID: k0874
MAC Address: c4:03:a8:94:40:ed
MAC Vendor: (Unknown vendor)
Creation: 2022-08-03 07:15:14
Volume Droid: dfd3afa8-2379-454e-933d-79122810ac8b
Volume Droid Birth: dfd3afa8-2379-454e-933d-79122810ac8b
File Droid: 04dd5cc1-12fc-11ed-a039-c403a89440ed
File Droid birth: 04dd5cc1-12fc-11ed-a039-c403a89440ed
Property store data block (Format: GUID\ID Description ==> Value)
f29f85e0-4ff9-1068-ab91-08002b27b3d9\4 Author ==> 강현수
b725f130-47ef-101a-a5f1-02608c9eebac\10 Item Name Display ==> [BOB_DF11]강현수중심극한과큰수.docx
b725f130-47ef-101a-a5f1-02608c9eebac\15 Date Created ==> 08/04/2022 02:03:06
b725f130-47ef-101a-a5f1-02608c9eebac\12 Size ==> 35026
b725f130-47ef-101a-a5f1-02608c9eebac\4 Item Type Text ==> Microsoft Word 문서
b725f130-47ef-101a-a5f1-02608c9eebac\14 Date Modified ==> 08/04/2022 13:38:20
28636aa6-953d-11d2-b5d6-00c04fd918d0\30 Parsing Path ==> C:\Users\82103\Desktop[BOB_DF11]강현수중심극한과큰수.docx
446d16b1-8dad-4870-a748-402ea43d788c\104 Volume Id ==> Unmapped GUID: fa08bf56-1774-486a-98ac-86331745c68a
e3e0584c-b788-4a5a-bb20-7f5a44c9acdd\6 Item Folder Path Display ==> C:\사용자\82103\바탕 화면
- lecmd
LnkFileName MachineID FileName FilePath FileSize(Byte) LnkCreationTime LnkAccessTime LnkWriteTime TargetCreationTime TargetAccessTime TargetWriteTime DriveType VolumeLabel DriveSerialNumber MAC Address
[BOB_DF11]강현수중심극한과큰수.docx - 바로 가기.lnk k0874 [BOB_DF11]강현수중심극한과큰수.docx C:\Users\82103\Desktop[BOBDF11]강현수중심극한과큰수.docx 35026 2022-09-14 11:38 2022-09-14 11:47 2022-09-14 11:38 2022-08-04 11:03 2022-09-14 11:38 2022-08-04 22:38 DRIVE FIXED d071202b c4:03:a8:94:40:ed
- lnk parser
- 원본 파일 MAC Time
- 가리키는 파일의 경로
- 원본 파일의 크기
- Birth Volume ID *
- Birth Object ID *
- Machine ID (분석 대상 컴퓨터의 이름)
- 원본 MAC 주소
- New Volume ID *
- New Object ID *
- LNK의 MAC Time
- Volume Droid *
- File Droid *
- GUID
