LECmd (LNK files)

LECmd.exe -d <path> --csv <out>

Parses LNK files (shortcuts) with LECmd, revealing the files and programs they pointed to and their activity.

Run it when you need to know what the system's shortcuts pointed to: LNKs (on the desktop, Recent, the startup folder, and Jump List dumps) store the target path, icon, and timestamps — and LECmd converts them to CSV with detail. In IR, LNKs answer 'what was created or opened from this shortcut?': the payload LNK in the startup folder (persistence), the phishing document LNK in Recent, or the LNKs the attacker created to launch their tools. They also reveal drive activity (LNKs from Jump List dumps point to opened files).

Don't use it as a complete record: LNKs only exist if they were created — programs launched via console or scripts don't generate LNKs, and the attacker can delete them. Retention is limited (Recent is pruned). And beware: LNK interpretation depends on context — an LNK in Recent points to a file that was opened (not necessarily touched by the attacker); correlation with other artifacts decides. For LNK persistence (Startup), the finding is the LNK in the startup folder with an unusual target. LNK timestamps (creation, access, modification) are cross-referenced with the MFT.