Skip to content
Get packs

Windows LNK Forensic Analyzer

Parses Windows shortcut (.lnk) files to reconstruct file access history for forensic timelines

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

This skill teaches an AI agent how to read Windows shortcut files (.lnk), which Windows creates automatically whenever a user opens a document or program, and which are also left in Recent and Desktop folders. The agent can pull out the path of the file that was opened, timestamps, details about the USB drive or network share it lived on, and the name of the computer it was on, then organize these into a timeline for a digital forensics investigation. It also includes a Python script (scripts/agent.py) that parses a folder of LNK files and writes results to a CSV file.

Great for

  • Digital forensics and incident response analysts reviewing a disk image from a Windows machine
  • Security teams tracing whether a user opened files from USB drives or network shares
  • Students learning how Windows artifacts record user activity

Skip it if

  • Live production systems or anyone without authorization to examine the data, since it reveals user activity and may involve personal information
  • Court-admissible evidence without validation, because the skill relies on third-party parsers and does not describe chain-of-custody or verification of its own output

Try asking

  • “Parse all LNK files in my recent-items folder and list the target paths and drive types”
  • “Build a timeline of files opened from removable media using these shortcut files”
  • “Extract machine IDs and volume serial numbers from these .lnk files for my case notes”
  • “Check the Startup folder shortcuts for anything that looks like persistence”
Step-by-step guide: how to use Windows LNK Forensic AnalyzerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-windows-lnk-files-for-artifacts.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-windows-lnk-files-for-artifacts.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-windows-lnk-files-for-artifacts.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Work on a copy or read-only mount of the evidence so the originals are never altered, as the SKILL.md workflow does with a read-only loop mount
  • Verify key findings with a second tool such as LECmd before relying on them in a report
  • Review scripts/agent.py before running it on evidence, since it executes Python code on the files you give it

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.