dissect.shellitem.lnk#

Submodules#

Package Contents#

Classes#

Lnk

This class represents a LNK file's SHELL_LINK_HEADER, and the remainder of the parsed LNK file structures.

Attributes#

c_lnk

class dissect.shellitem.lnk.Lnk(fh: io.BufferedReader, target_idlist: LnkTargetIdList | None = None, linkinfo: LnkInfo | None = None, stringdata: LnkStringData | None = None, extradata: LnkExtraData | None = None)#

This class represents a LNK file’s SHELL_LINK_HEADER, and the remainder of the parsed LNK file structures. This SHELL_LINK_HEADER structure contains identification information, timestamps, and flags that specify the presence of optional structures.

Parses a .lnk file (aka Microsoft Shell Item) according to the MS-SHLLINK specification reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/%5bMS-SHLLINK%5d.pdf

Parameters:

  • path – (string) Path to a link file.

  • target_idlist – A LnkTargetIdList object.

  • linkinfo – A LnkInfo object.

  • stringdata – A LnkStringData object.

  • extradata – A LnkExtraData object.

property clsid: uuid.UUID#

Returns the class id (clsid) of the LNK file.

flag(name: str) → int#

Returns whether supplied flag is set.

Parameters:

name – Name of the flag

Returns:

>0 if flag is set

Return type:

int

__repr__() → str#

Return repr(self).

dissect.shellitem.lnk.c_lnk#