I access a files which name is "abc.doc", no doubt a lnk file "abc.doc.lnk" shows up. Few minutes or hours later I access "abc.doc" again, what will happen then? "abc.doc.lnk" still or another lnk file "abc.doc (2).lnk" show up???

Yesterday I analyzed artifacts of an evidence which operating system is Windows XP SP3. When I took a look at "Recent folders", some lnk files look strange. Under what circumstances could so many same lnk files show up as below? You guys could take a look at the timestamps of file that those lnk files pointing to. The same CreationDate and these lnk files do point to the same file "其它各類所得.xlsx".

I'd appreciate your providing any information you have. Thanks a lot.

What is the behavior of lnk files?的更多相关文章

  1. Track files and folders manipulation in Windows

    The scenario is about Business Secret and our client do worry about data leakage. They want to know ...

  2. How to: Synchronize Files by Using Managed Code

    The examples in this topic focus on the following Sync Framework types: FileSyncProvider FileSyncOpt ...

  3. EnCase missed some usb activities in the evidence files

    My friend is a developer and her colleague May was suspected of stealing the source code of an impor ...

  4. What are Unix swap (.swp) files?

    原文: http://www.networkworld.com/article/2931534/it-management/what-are-unix-swap-swp-files.html ---- ...

  5. Introducing Microsoft Sync Framework: Sync Services for File Systems

    https://msdn.microsoft.com/en-us/sync/bb887623 Introduction to Microsoft Sync Framework File Synchro ...

  6. 1Z0-050

    QUESTION 13 View the Exhibit.Examine the following command that is executed for the TRANSPORT table ...

  7. Total Commander 8.52 Beta 1

    Total Commander 8.52 Beta 1http://www.ghisler.com/852_b1.php 10.08.15 Release Total Commander 8.52 b ...

  8. metasploit-post模块信息

    Name                                             Disclosure Date  Rank    Description ----           ...

  9. Volume serial number could associate file existence on certain volume

    When it comes to lnk file analysis, we should put more emphasis on the volume serial number. It coul ...

随机推荐

  1. Python分布式爬虫原理

    转载 permike 原文 Python分布式爬虫原理 首先,我们先来看看,如果是人正常的行为,是如何获取网页内容的. (1)打开浏览器,输入URL,打开源网页 (2)选取我们想要的内容,包括标题,作 ...

  2. pythomn

    等我学号数据结构,明年就去找三胖 前端,写js相关代码.了解前端架构 而非页面设计 主要使用的是脚本语言 了解http web相关技术等 知道页面调优 浏览器加载方式等

  3. 简单数据访问类，生成简单SQL，自动转换成java对象

    import java.util.HashMap; import java.util.List; import java.util.Map; import org.slf4j.Logger; impo ...

  4. MySQL的时间进位问题

    mysql更新到5.6.4 之后 , 新增了一个叫factional seconds的特性 , 可以记录时间的毫秒值. 但是目前的数据库是不记录毫秒值的 , 所以会产生一个java中时间的Millis ...

  5. ylbtech-Unitity-CS-Arrays:数组

    ylbtech-Unitity-CS-Arrays:数组 1.A,效果图返回顶部   1.B,源代码返回顶部 1.B.1, using System; class DeclareArraysSampl ...

  6. 修改Jenkins启动衍生进程的生命周期

    Jenkins+jmeter 多线程测试java接口时爆错,导致无法生成html报告. 先介绍下场景: 在Jenkins中新建了一个Job,假设你在一些列Build Step之前/之后,启动了一个进程 ...

  7. sqlldr导入数据

    直接在cmd输入sqlldr即可,不需要先输sqlplus. 参考链接:每次提交多少行很重要:http://www.cnblogs.com/wingsless/archive/2012/08/04/2 ...

  8. FreeMarker页面中获得contextPath

    要在ftl页面中使用contextPath,需要在viewResolver中做如下配置(红色部分): <bean id="viewResolver" class=" ...

  9. SVN提交数据失败问题（提示 svn:MKACTIVITY ... 403 Forbidden ）

    注册了淘宝svn,结果在代码提交是老是出问题,如下截图所示: 网上有常用的一种方法是: http://jingyan.baidu.com/article/67508eb4d3f2e29ccb1ce47 ...

  10. Java String 的实例(02)

    1.初始化数组以及数组的拷贝 int[] a={1,2,3,4};        //System.out.println(Arrays.toString(a));        a=new int[ ...