When it comes to lnk file analysis, we should put more emphasis on the volume serial number. It could help forensic guys to identify whether files exist(ed) on certain volume or not. Let's take a look at lnk files as below:

1. Take a look at AndroidGestureSHA1.txt.lnk, and you could see the vol serial is "149F-651D". Also you could use DOS command "vol" to check it out. Yes, the volume serial number of my C partition is "149F-651D".

2. Next we take a look at EN2015061801.html.lnk. The vol serial is "B3A6-DB3C" and it's a Removable drive which volume name is "XPE".

3. But one thing which is very important: if you format the volume..guess what? Yes, the volume serial change after formatting. Let me show you the effect of formatting to volume serial number.

Before formatting the volume serial number is "B3A6-DB3C"

Now I format it.

After formatting the volume serial number becomes "7887-6B77"

Now you know that if the volume being formated and the volume serial number will change. Don't forget the effect of formatting to volume serial number. Take it into consideration whenever you analyze volume serial number association with another clues.

Volume serial number could associate file existence on certain volume的更多相关文章

  1. Associate File Type with Qt In Mac Os and Win

    Win Registry Question One day, my boss want me to finish one function which let the users can double ...

  2. 解决软件卸载时Abstract: "Invalid serial number" xe4

    In RAD Studio, Delphi, C++Builder, XE4 there can become a scenario if you try to modify, repair, upg ...

  3. open数据库报错ERROR at line 1: ORA-03113: end-of-file on communication channel Process ID: 3880 Session ID: 125 Serial number: 3

    1.今天打开数据时,失败,报错 ERROR at line 1:ORA-03113: end-of-file on communication channelProcess ID: 3880Sessi ...

  4. UnsupportedClassVersionError: Bad version number in .class file

    java.lang.UnsupportedClassVersionError: Bad version number in .class file造成这种过错是ni的支撑Tomcat运行的JDK版本与 ...

  5. java.lang.UnsupportedClassVersionError: Bad version number in .class file异常

    java.lang.UnsupportedClassVersionError: Bad version number in .class file异常 部署工程时也出现过因为版本不同引起的问题,那时我 ...

  6. Bad version number in .class file

    TY项目是用JDK1.6做的,早先在电脑上装了一个1.5的,这回就不能用了.为了能用,我就又装了一个1.6的,修改了环境变量之后,以为一切OK.开始测试,首先在Myeclipse中打开我用1.5编的一 ...

  7. oracle.jbo.JboException: JBO-29000: JBO-29000: Bad version number in .class file

    我在本地run Page的时候报以下错误. oracle.jbo.JboException: JBO-29000: JBO-29000: Bad version number in .class fi ...

  8. Java Bad version number in .class file

    错误信息: java.lang.UnsupportedClassVersionError: Bad version number in .class file at java.lang.ClassLo ...

  9. Source insight 3572版本安装及An invalid source insight serial number was detected解决方法

    Source insight有最新版3572.3.50.0076 下载连接:http://www.sourceinsight.com/down35.html,   http://www.sourcei ...

随机推荐

  1. NeHe OpenGL教程 第十三课:图像字体

    转自[翻译]NeHe OpenGL 教程 前言 声明,此 NeHe OpenGL教程系列文章由51博客yarin翻译(2010-08-19),本博客为转载并稍加整理与修改.对NeHe的OpenGL管线 ...

  2. Linux Tcpdump 使用举例 ---持续更新

    举例: 保存到文件tcpdump -w xxx.cap(默认抓取eth0的包) 抓eth1的包 tcpdump -i eth1 -w /tmp/xxx.cap 抓到完成的数据包(默认只抓前68字节) ...

  3. [物理学与PDEs]第4章 反应流体力学

    [物理学与PDEs]第4章第1节 引言 [物理学与PDEs]第4章第2节 反应流体力学方程组 2.1 粘性热传导反应流体力学方程组 [物理学与PDEs]第4章第2节 反应流体力学方程组 2.2 反应流 ...

  4. centos7通过firewalld更改sshd端口

    1.设置selinux端口 [root@hn ~]# semanage port -l|grep ssh -bash: semanage: 未找到命令 [root@hn ~]# whereis sem ...

  5. 关于htmlspecialchars实体字符转码的问题

    php对post过来的数据进行实体字符转码,我的页面编码是gb2312,刚开始是这样: $post = htmlspecialchars ( $post); 取到的$post值为空,但是有时候是好的( ...

  6. 设置presentVC跟PushVC一样的效果即从右到左的动画

    SettingViewController *VC = [[SettingViewControlleralloc]init]; VC.view.backgroundColor = [UIColorwh ...

  7. C++学习39 异常处理入门(try和catch)

    编译器能够保证代码的语法是正确的,但是对逻辑错误和运行时错误却无能为力,例如除数为 0.内存分配失败.数组越界等.这些错误如果放任不管,系统就会执行默认的操作,终止程序运行,也就是我们常说的程序崩溃( ...

  8. [SQL]SQL语言入门级教材_SQL数据操作基础(二)

    SQL数据操作基础(初级) netnova 于 -- :: 加贴在 数据库探讨: 为了建立交互站点,你需要使用数据库来存储来自访问者的信息.例如,你要建立一个职业介绍服务的站点,你就需要存储诸如个人简 ...

  9. C++primer 练习12.27

    // 12_27.cpp : 定义控制台应用程序的入口点. // #include "stdafx.h" #include<iostream> #include< ...

  10. Find the Clones(字典树)

    链接:http://poj.org/problem?id=2945 Description Doubleville, a small town in Texas, was attacked by th ...