LNK & Jumplist Browser

[Update]

• Removed some obsolete test code

• Reminder about the Target File Size:
  ShellLinkHeader => FileSize (4 bytes): A 32-bit unsigned integer that specifies the size, in bytes, of the link target. If the link target file is larger than 0xFFFFFFFF, this value specifies the least significant 32 bits of the link target file size.

  

---

MD5: F34E3B2768CBB4075BCDB6E67B62E3BB
SHA256: A875154A16E4A54882F1BD151454BB90563D96175696BA5DBFD11A315A8A50E6

LNK & Jumplist Browser

[Updates]

• Added highlighted background to the target File Size when it's greater than 0xFFFFFFFF
  (Note the SHLLINK Header's Target File Size in the top line below):

  
  

• Updated an ItemID Type: [00] variant:

  
  

• Other small corrections

---

MD5: 378A85CB727FAA7AC214D810D938BCD8
SHA256: 27F4B36ABFBAFAFB320DB3C882274F5743237A51F5BB166D5B7E1CDBAA9A93EB

LNK & Jumplist Browser

[Updates]

• Added support for LNK 64bit target File Size (see the PDF for more info & comparisons):

  
  

  Maximum 32bit File Size: 4.294.967.295 (0xFF FF FF FF):
  
  

  64bit File Size: 4.294.967.296 (0x00 00 00 00 01 00 00 00):
  
  

  64bit File Size: 4.294.967.297 (0x01 00 00 00 01 00 00 00):
  
  

  ShellLinkHeader => FileSize (4 bytes): A 32-bit unsigned integer that specifies the size, in bytes, of the link target. If the link target file is larger than 0xFFFFFFFF, this value specifies the least significant 32 bits of the link target file size.

• Updated ItemID Type: [00] variants

• Added support for ItemID Extensions BEEF0013 & BEEF0019:

  
  

---

[Edit ]
Added below "LNK 32-64bit size test files.zip" which includes 3 test LNK (Shortcut) files for testing with other tools:

---

MD5: DC565990E605662898E899DA4D5566C3
SHA256: 0EE6DADCA477CFC90BF3E653E679734EEDCEF8F55DF6853F64E27F04BBECA303

JumplistBrowser

[Updates]

• Updated the ItemID Type: C3 variants (Hint: Flags):

  

  Sample with an extension:
  

• Changed Reparse point color:
  

• Updated an ItemID Type: 00 variant to show Extensions:
  

MD5: 8432BA990AAD99910F3150B5D011D6CE
SHA256: 130EDCFD8E59F692C7495CCF614FBE627B27DB2DF4E1AD3F86C2C657D68854ED

JumplistBrowser

[Updates]

• Updated the ItemID Type: C3 variants

• corrected the 'Save LNK to Json':

  
  

• other small corrections & checks

MD5: 8564A22169F48FF1FE8D2AB9E7FB177A
SHA256: AE717DFB41C268998BB6FBD60528241EF8933E7543A1AFE358EF54C49027A9EB

JumplistBrowser

[Updates]

• Corrected itemID type 'B1':

  
  

  from the $MFT FILE record:

  
  

  for comparison, the actual directory:

  
  
  
  

• Updated Extension [BEEF0029] to support 4byte long Attribute flags :

  

  for reference, the same directory's $MFT record:
  
  $Standard_Information flags:
  
  (File Attribute Constants)
  (FILE_ATTRIBUTE_DEVICE):
  A handle to the device on which the operation is to be performed. The device is typically a volume, directory, file, or stream.

• Extended Serialized Property Store (1SPS) support for a few more Extensions

($MFT record screenshots from MFTbrowser)

MD5: BA7F0D9FD8EA1A68038E8808EFEE0BC1
SHA256: 1ABBE97ECFBB73D9AD26814F73EA6F84AF8A3DF707721CE6A6FDB6F0C2B9C8F6

JumplistBrowser

[Updates]

• Changed the Timestamp Dates to the form of dd-MMM-yyyy

• In Extension Type [BEEF0004], if the extension version is 9, and the file attribute flags contain "Reparse_ Point",
  it contains the $Reparse point Tag of the $MFT record (if it exists):

  

Example #1 - Offline file in Onedrive :

Example #2 - Folder in Dropbox:

Example #3 - Registry MRU (CLSID_OneDrivePersonal [018D5C66-4533-4307-9B53-224DE2ED1FE6]):

Example #4: (16f2f0042ddbe0e8.customDestinations-ms):

MD5: 7C3DB55B3B1B5A1A8B358288578CF88F
SHA256: 7B0A42C8A7E415DD887F877D0E94AC7BFFA32B9D8DC74DE2CA315E2DE9F37387

JumplistBrowser

[Updates]

• Added support for the all the 'ShowCommand' possible values .
  While officially [MS-SHLLINK] supports only 3: options (SW_SHOWNORMAL, SW_SHOWMAXIMIZED & SW_SHOWMINNOACTIVE), this can be ..manually changed:

  
  

• Other minor updates/corrections

MD5: DB5EF57A21ADDC41A8A708783B93B8B7
SHA256: FDC3AA623648B32FB9FB9B785DD443436BA58C3E9CA249FE9F6A2EABBB62D43B

JumplistBrowser

[Updates]

• Added option to carve & display LNK files from raw files (bin,001,etc)
  (needs more testing)
• If an 'automaticDestinations-ms' file is corrupted, it will automatically try to carve out the LNK entries from the streams and display them.
• Added right click option to export a LNK to JSON
  

MD5: 9B2B374E46BAF92D41185E1C1C4E3765
SHA256: 334B384B2A072BA44C82A1FABC90DDB5AB5E2DACC04FA9E081ACAE910C35CD60

JumplistBrowser

[Updates]

• A few small corrections & one update

MD5: 5EE0D58ACA3552760E2FF852C4DD2600
SHA256: C25A61E2B23FB17421635EEE050A2198F996A1E0B0A27AD754E8BB71B6681FF6