search

sepinf-inc / IPED

IPED Digital Forensic Tool. It is an open source software that can be used to process and analyze digital evidence, often seized at crime scenes by law enforcement or in a corporate investigation by private examiners.
Other
965 stars 220 forks source link

Extract specific metadata from LNK files. Make reference to linked file. #2307

Open patrickdalla opened 2 months ago

patrickdalla commented 2 months ago

Extracts specific metadata from LNK files, like local path, volumelabel and networkshare.

Also, some info can be used to local the referenced file, and register the reference to in "linkedItems" prop so it is show in References Tab.

patrickdalla commented 2 months ago

At first, I found that adding the timestamps of LNK source registered inside LNK would lead in redundancies. But, as we already check if the referenced item exists, we can check if those timestamps coincides, and register only the different ones.

So, if MODDATE inside LNK is different than the correspondent item found MODDATE, it will be added in new metadata, meaning that the source has been modified after its opening through the LNK. Also to access date. Creation date is already used to confirm the file, as if it have a different creation date it can mean another file with same path/name or mft idx. So if creation date does not match, the item is not considered the source of the LNK, and all source timestamps information are added.

I will push the commits of the above implementation right after final tests.