Skip to content
Get packs

Guide · Agent skill

How to use the LNK and Jump List Forensics agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This is an agent skill that teaches an AI agent how to examine Windows shortcut (LNK) files and Jump Lists, small records Windows creates when a user opens files or programs. It is written for digital forensics examiners, incident responders and students who work from a Windows disk image or triage collection. After following this guide you will know how to install the skill, ask for LNK and Jump List analysis in plain language, and what inputs and tools the work requires.

LNK and Jump List Forensicsmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download and unzip the skill. Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use or the .claude/skills/ folder of a project.
  2. 2Prepare the evidence. Collect a forensic image or triage collection from the Windows system and work from a copy.
  3. 3Install the tools. Install Python 3.8 or newer, and obtain LECmd and JLECmd from Eric Zimmerman to run on Windows.
  4. 4Ask for the analysis. Describe the investigation in plain language, naming the artifact type and the question you need answered.
  5. 5Run the parsers. Run LECmd for LNK files and JLECmd for Jump Lists against the Recent folder, exporting to CSV.
  6. 6Review and document. Review the CSV output in Timeline Explorer if you have it, and fill in the assets/template.md report.

What is an agent skill and what does this one do?

An agent skill is a folder of instructions and supporting files that an AI agent can load when a task matches the skill's description. This one centres on SKILL.md, which tells the agent how to analyse LNK and Jump List artifacts and how to use Eric Zimmerman's LECmd and JLECmd tools.

The agent can explain what these records show: which files were opened, when, and from which computer. The source notes this holds even after the target file has been deleted, because the records persist. The skill also includes scripts/agent.py and scripts/process.py, and a Python example that reads the 76-byte Shell Link header directly.

  • Explains LNK file locations such as the Recent folder, Desktop, Start Menu and Office Recent.
  • Guides LECmd and JLECmd commands for parsing LNK files and AutomaticDestinations and CustomDestinations Jump Lists.
  • Covers evidence of file access, removable media use (drive letters, volume serial numbers) and network share (UNC path) activity.
  • Provides a report template in assets/template.md with sections for case information, LNK summary, Jump List summary and findings.

How do you install the skill?

Download the ZIP file from this page. Then choose one of two routes.

For a personal install, unzip the file into ~/.claude/skills/. For a project install, unzip it into the .claude/skills/ folder of your project. You can also upload the skill in the Claude apps under Settings → Capabilities → Skills.

  • Personal: unzip into ~/.claude/skills/
  • Project: unzip into .claude/skills/ inside your project
  • Claude apps: Settings → Capabilities → Skills, then upload

What do you need before you start?

The skill needs a Windows forensic image or triage collection, plus several tools that you run separately. The agent does not supply these artifacts itself.

Python 3.8 or newer is required. LnkParse3 or pylnk3 are optional Python libraries used by agent.py. LECmd and JLECmd are Windows tools from Eric Zimmerman that you run on your own machine. Timeline Explorer is optional and used to review CSV output.

  • Python 3.8+
  • LnkParse3 or pylnk3 (optional, used by agent.py)
  • LECmd and JLECmd from Eric Zimmerman (Windows, run separately)
  • Forensic image or triage collection from a Windows system
  • Timeline Explorer for CSV review (optional)

How do you trigger the skill with a natural request?

You do not need to type a command to load the skill. Describe the task in plain language and mention the artifact. The skill's description covers investigating Windows user activity, reconstructing file-access or program-execution timelines, and examining recent or frequently used file evidence.

Give the agent the context it needs: the case scope, the path to the exported Recent folder or Jump List files, and the question you are trying to answer.

  • "Using the LNK and Jump List skill, list which documents were opened from this user's Recent folder and when."
  • "Check whether any LNK files point to removable drive letters E: or F: and report the volume serial numbers."
  • "Parse the AutomaticDestinations Jump Lists and summarise activity for Microsoft Word and Excel."
  • "Find LNK files with UNC paths and identify the remote server names."

What commands does the skill use?

The skill documents LECmd and JLECmd invocations. Run them on a Windows examiner workstation against copies of the evidence. The examples below are taken from the skill's instructions.

LECmd.exe -d "C:\Evidence\Users\suspect\AppData\Roaming\Microsoft\Windows\Recent" --csv C:\Output --csvf lnk_analysis.csv JLECmd.exe -d "C:\Evidence\Users\suspect\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations" --csv C:\Output --csvf jumplists_auto.csv

What does the skill's safety and privacy profile look like?

The skill runs scripts, so review scripts/agent.py and scripts/process.py before use. The skill does not use the network, according to its listing. Its guidance says reading user activity records can raise privacy and legal issues.

Only examine systems or images you are authorised to analyse. The skill is not for live systems you have no authority to examine. It is also not a file recovery tool, because these artifacts show access history rather than file contents.

  • Runs scripts: yes. Read them first.
  • Uses network: no.
  • Work on copies of evidence and keep original artifacts unmodified.
  • Confirm legal authority before examining any user's activity.

What tips help you get reliable results?

Treat LNK and Jump List evidence as one part of a wider timeline. The source suggests cross-referencing LNK timestamps with MFT timestamps and USN Journal entries. Record which AppID hash maps to which application, using the table in the skill's reference material.

Be aware of version differences. The skill notes that Windows 11 can produce different LNK and Jump List artifacts from Windows 10, so state the Windows version in your findings.

  • Cross-reference LNK times with MFT and USN Journal entries.
  • Filter LECmd CSV output by target path to focus on specific files.
  • Note that a Windows 10 and Windows 11 difference exists; document the version you examined.

What people use it for

  • Reconstructing which documents a user opened and when, even after the files were deleted.
  • Identifying removable media use by matching drive letters and volume serial numbers in LNK files.
  • Finding network share access through UNC paths and NetBIOS names.
  • Summarising per-application activity from AutomaticDestinations Jump Lists, such as Word or Excel.

Frequently asked questions

How do I install the LNK and Jump List Forensics agent skill?

Download the ZIP from this page and unzip it into ~/.claude/skills/ for a personal install, or into a project's .claude/skills/ folder. You can also upload it in the Claude apps under Settings → Capabilities → Skills.

What do I need to run this skill?

You need Python 3.8 or newer, a forensic image or triage collection from a Windows system, and LECmd and JLECmd from Eric Zimmerman, which run on Windows. LnkParse3 or pylnk3 are optional libraries, and Timeline Explorer is optional for reviewing CSV output.

Is the skill free and what is its licence?

The skill is licensed under Apache-2.0, as stated on this page. Eric Zimmerman's LECmd and JLECmd are separate tools that you run on your own machine, and their licensing is outside this skill's listing.

Does this skill recover deleted files?

No. The source says these artifacts show access history rather than file contents, so they record that a file was opened and when, but do not recover the file itself.

Does the skill send my evidence over the network?

The listing states that the skill does not use the network. It does run scripts, so review scripts/agent.py and scripts/process.py before use.

What other tools can I use instead of LECmd?

The skill's reference material lists LnkParse3 as a cross-platform Python LNK parser and Magnet AXIOM as a commercial forensic tool with LNK and Jump List support. Choose based on your platform, budget and what your team already uses.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits forensic examiners, incident responders and students who already have authorised access to a Windows image and want an agent to structure LNK and Jump List analysis. It is less suitable for live systems you are not authorised to examine, for file recovery, or for anyone who cannot run Windows tools like LECmd and JLECmd.

Download the skill