Results for “lecmd”

Examine Windows shortcuts and Jump Lists, records of recently used files, to reconstruct user activity. Extract paths, timestamps, and device details with LECmd and JLECmd, including traces that remain after target files are deleted.

• Reconstructing file access and program execution timelines
• Investigating access to files that have been deleted
• Examining traces of removable media use

Examine Windows shortcut files to recover target paths, timestamps, drive identifiers, and machine details. Organize these traces into an investigation timeline covering local documents, USB devices, network shares, and suspicious startup shortcuts.

• Reconstruct document access history from Windows shortcuts
• Trace references to files on USB devices
• Investigate access to network shares

Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.

The English summary is being prepared. Showing the original description.

Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.

The English summary is being prepared. Showing the original description.

Analyze Windows LNK shortcut files and Jump List artifacts to establish evidence of file access, program execution, and user activity using LECmd, JLECmd, and manual binary parsing of the Shell Link Binary format.

The English summary is being prepared. Showing the original description.