lnk file parser for windows recent accessed files.

Found some interesting sounding recently accessed files on a windows 7 machine in
C:\Users\%UserName%\AppData\Roaming\Microsoft\Windows\Recent

I was after a free utility that will pull out all the relevant fields from each lnk shortcut file and put them into an excel spreadsheet in a nice tabular format. The few I tried either put them in a bizarre format or didn't pull all the key fields from each lnk file, i.e. location the file existed etc.
LVL 4
pma111Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

ChopOMaticCommented:

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
pma111Author Commented:
btanExec ConsultantCommented:
this lnk parser can be handy since it also has the export to csv
https://code.google.com/p/lnk-parser/
BillDLCommented:
I've used the MiTEC utilities (as suggested by ChopOMatic) and also Nir Sofer's free utilities for years.  While not intended nor guaranteed for forensic purposes, some of Nir Sofer's programs dig quite deep.  For your simple purposes you can use: http://www.nirsoft.net/utils/recent_files_view.html
It is a standalone EXE that creates its own *.cfg file when configured in the user options and the interface is arranged to suit, or can be run from the command line to output some usefully formatted results including CSV, so it can regarded as "portable".  Note:  you have to select all the rows in the program window to use the File menu > Save As option, or it just saves details of the one field that is currently selected.  Also explore the Right-Click options.

I assume that you are fully aware that by accessing any LNK files and their target files with such a utility could invalidate any future proper forensic examination?

If you ever simply want a list of LNK files in a folder and all sub-folders, along with the target files found in them, a simple batch file would work for this purpose.  I found an old one that I used to use.  It will produce a listing of LNK files found in whatever folder you run it from, and those found in all sub-folders below that, and extracts the path of the targets from each to the report.  Not in CSV format (just two lines for each result), but could probably be modified quite easily to a 2-column CSV.  It's actually just a condensed version of a batch file i used to run to check for Windows shortcuts where the target file no longer existed and I had the batch file delete the respective shortcuts.
@echo off
SetLocal EnableDelayedExpansion
set CurrDir=%~dp0
set CurrDir=%CurrDir:~0,-1%
set RESULTS=%CurrDir%\Parsed_LNKs.txt
if exist "%RESULTS%" del "%RESULTS%">nul

for /r "%CurrDir%" %%A in (*.lnk) do (
    set LNKFILE=%%A
    echo Parsing: "!LNKFILE!" ...
    echo "!LNKFILE!">>"%RESULTS%"
    type "!LNKFILE!" | find /i "C:\" | find /i /v "/">>"%RESULTS%"
    echo.>>"%RESULTS%"
)
pause

Open in new window

BillDLCommented:
Thank you pma111
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Digital Forensics

From novice to tech pro — start learning today.