Skip to content
Get packs

LNK and Jump List Forensics

Lets an agent analyze Windows shortcut and Jump List files to reconstruct file access and program use.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
7 files

What it does

This skill teaches an AI agent how to examine Windows shortcut files (LNK) and Jump Lists, small records Windows creates when a user opens files or programs. The agent can explain what these records show, such as which files were opened, when, and from which computer, even if the original file has since been deleted. It guides use of Eric Zimmerman's LECmd and JLECmd tools and includes Python scripts that read the file headers directly.

Great for

  • Digital forensics examiners reviewing a Windows disk image or triage collection
  • Incident responders reconstructing what a user accessed and when
  • Students learning Windows forensic artifacts

Skip it if

  • Live systems you do not have authority to examine, because reading user activity records can raise privacy and legal issues
  • Quick file recovery, since these artifacts show access history rather than file contents

Try asking

  • “Parse all LNK files in this user's Recent folder and summarize which documents were opened and when”
  • “Explain what the Jump List entries for Microsoft Word show about recent activity on this machine”
  • “Build a timeline of file access from these LNK and AutomaticDestinations files”
Step-by-step guide: how to use LNK and Jump List ForensicsInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 7 original files, the Apache-2.0 licence and an attribution note.

    analyzing-lnk-file-and-jump-list-artifacts.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-lnk-file-and-jump-list-artifacts.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-lnk-file-and-jump-list-artifacts.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Work on a copy of the evidence so the original artifacts are not altered during analysis
  • Cross-check results from the Python scripts against LECmd and JLECmd output before relying on them in a report
  • Review the scripts before running them on sensitive evidence, since they execute locally on the files you point them at

What's inside

  • assets/template.md
  • references/api-reference.md
  • references/standards.md
  • references/workflows.md
  • scripts/agent.py
  • scripts/process.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.