I access a files which name is "abc.doc", no doubt a lnk file "abc.doc.lnk" shows up. Few minutes or hours later I access "abc.doc" again, what will happen then? "abc.doc.lnk" still or another lnk file "abc.doc (2).lnk" show up???

Yesterday I analyzed artifacts of an evidence which operating system is Windows XP SP3. When I took a look at "Recent folders", some lnk files look strange. Under what circumstances could so many same lnk files show up as below? You guys could take a look at the timestamps of file that those lnk files pointing to. The same CreationDate and these lnk files do point to the same file "其它各類所得.xlsx".

I'd appreciate your providing any information you have. Thanks a lot.

What is the behavior of lnk files?的更多相关文章

  1. Track files and folders manipulation in Windows

    The scenario is about Business Secret and our client do worry about data leakage. They want to know ...

  2. How to: Synchronize Files by Using Managed Code

    The examples in this topic focus on the following Sync Framework types: FileSyncProvider FileSyncOpt ...

  3. EnCase missed some usb activities in the evidence files

    My friend is a developer and her colleague May was suspected of stealing the source code of an impor ...

  4. What are Unix swap (.swp) files?

    原文: http://www.networkworld.com/article/2931534/it-management/what-are-unix-swap-swp-files.html ---- ...

  5. Introducing Microsoft Sync Framework: Sync Services for File Systems

    https://msdn.microsoft.com/en-us/sync/bb887623 Introduction to Microsoft Sync Framework File Synchro ...

  6. 1Z0-050

    QUESTION 13 View the Exhibit.Examine the following command that is executed for the TRANSPORT table ...

  7. Total Commander 8.52 Beta 1

    Total Commander 8.52 Beta 1http://www.ghisler.com/852_b1.php 10.08.15 Release Total Commander 8.52 b ...

  8. metasploit-post模块信息

    Name                                             Disclosure Date  Rank    Description ----           ...

  9. Volume serial number could associate file existence on certain volume

    When it comes to lnk file analysis, we should put more emphasis on the volume serial number. It coul ...

随机推荐

  1. studio_ 优化Android Studio 启动、编译和运行速度？

    http://www.admin10000.com/document/6842.html: 作为一名 Android 程序员,选择一个好的 IDE 工具可以使开发变得非常高效,很多程序员喜欢使用 Go ...

  2. SQL Server 2008 建立分区表 脚本

    /*第一步:创建分区函数*/Create partition function Part_func_Bag(varchar(20)) as range right /*正式区间for values(N ...

  3. 清除xcode里面的mobileprovision文件

    清除所有的mobileprovision cd ~/Library/MobileDevice/Provisioning\ Profiles/ 然后删除里面所有的mobileprovision文件 rm ...

  4. 使用Jenkins搭建持续集成服务

    1. 什么是持续集成 持续集成 (Continuous Integration, 简称 CI) 是软件工程中的一种实践, 用于将开发人员不同阶段的工作成果集成起来, 通常一天之中会进行多次. 持续集成 ...

  5. 并发之 volatile

    使用volatile: 每次读取volatile变量的值,都强制从主存读取最新的值. (每次修改volatile变量都会同步到主存中) i++ 之所以不能保证线程安全,是因为volatile不能解决非 ...

  6. struts2访问servlet API

    搭建环境: 引入jar包,src下建立struts.xml文件 项目配置文件web.xml. web.xml: <?xml version="1.0" encoding=&q ...

  7. Go Mobile 例子 basic 源码分析

    OpenGL ES(OpenGL for Embedded Systems)是 OpenGL 三维图形API的子集,针对手机.PDA和游戏主机等嵌入式设备而设计.该API由Khronos集团定义推广, ...

  8. 关于 Python Iterator 协议的一点思考

    转:http://www.jianshu.com/p/dcf83643deeb Python 中有好几种容器或者序列类型:list tuple dict set str,对于这些类型中的内容,往往需要 ...

  9. dbf导入Oracle

    如果想通过拷贝数据文件来恢复数据库的话:1.要确定源数据库和目标数据库的安装目录等完全一致,os一致2.把源数据库的控制文件,spfile,密码文件拷贝到目标数据库的相同目录下3.通过源数据库的con ...

  10. cocos2d-x 游戏暂停界面，监听home键，返回键，Menu键 解决方案

    游戏暂停界面: cocos2d-x中游戏暂停界面提供的思路是用pushScene()和popScne(),即推进和弹出场景,当游戏暂停时,推进(pushScene())暂停场景,之前运行的场景将会自动 ...