dissect.shellitem.lnk.lnk
#
Module Contents#
Classes#
Class that represents the a LNK file's EXTRA_DATA stucture |
|
This class represents the LNK file's STING_DATA structure. The STRING_DATA structure refers to a set of |
|
This class represents a LNK file's LINK_INFO structure. The optional LINK_INFO structure specifies information |
|
This class represents a LNK file's TARGET_IDLIST structure. The TARGET_IDLIST structure specifies the target of |
|
This class represents a LNK file's SHELL_LINK_HEADER, and the remainder of the parsed LNK file structures. |
Attributes#
- dissect.shellitem.lnk.lnk.log#
- class dissect.shellitem.lnk.lnk.LnkExtraData(fh: Optional[BinaryIO] = None)#
Class that represents the a LNK file’s EXTRA_DATA stucture This optional structure hold additional optional structures that convey additional information about a link target
- Parameters:
fh – A file-like object to an EXTRA_DATA structure
- __getattr__(attr: str) Any #
- __repr__() str #
Return repr(self).
- class dissect.shellitem.lnk.lnk.LnkStringData(fh: Optional[BinaryIO] = None, lnk_flags: Optional[dissect.shellitem.lnk.c_lnk.c_lnk.LINK_FLAGS] = None)#
This class represents the LNK file’s STING_DATA structure. The STRING_DATA structure refers to a set of structures that convey user interface and path identification information.
STRING_DATA = [NAME_STRING] [RELATIVE_PATH] [WORKING_DIR] [COMMAND_LINE_ARGUMENTS] [ICON_LOCATION]
- Parameters:
fh – A file-lke object to a STRING_DATA structure
lnk_flags – Parsed LINK_HEADER flags
- __getattr__(attr: str) Any #
- __repr__() str #
Return repr(self).
- class dissect.shellitem.lnk.lnk.LnkInfo(fh: Optional[BinaryIO] = None)#
This class represents a LNK file’s LINK_INFO structure. The optional LINK_INFO structure specifies information necesarry to resolve a link target if it is not found in its original location. This includes information about the volume that the target was stored on, the mapped drive letter, and a UNC path if existed when the link was created.
- Parameters:
fh – A file-like objet to a LINK_INFO structure
- flag(name: str) int #
Retuns whether supplied flag is set.
- Parameters:
name – Name of the flag
- Returns:
>0 if flag is set
- Return type:
int
- __getattr__(attr: str) Any #
- __repr__() str #
Return repr(self).
- class dissect.shellitem.lnk.lnk.LnkTargetIdList(fh: Optional[BinaryIO] = None, size: Optional[int] = None)#
This class represents a LNK file’s TARGET_IDLIST structure. The TARGET_IDLIST structure specifies the target of the link. This information is stored in individual ITEM_ID structures.
- Parameters:
fh – A file-like object to a TARGET_IDLIST structure.
size – Size of the TARGET_IDLIST structure
- __repr__() str #
Return repr(self).
- class dissect.shellitem.lnk.lnk.Lnk(path: Union[str, pathlib.Path], target_idlist: Optional[LnkTargetIdList] = None, linkinfo: Optional[LnkInfo] = None, stringdata: Optional[LnkStringData] = None, extradata: Optional[LnkExtraData] = None)#
This class represents a LNK file’s SHELL_LINK_HEADER, and the remainder of the parsed LNK file structures. This SHELL_LINK_HEADER structure contains identification information, timestamps, and flags that specify the pressence of optional structures.
Parses a .lnk file (aka Microsoft Shell Item) according to the MS-SHLLINK specification reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/%5bMS-SHLLINK%5d.pdf
- Parameters:
path – (string) Path to a link file.
target_idlist – A LnkTargetIdList object.
linkinfo – A LnkInfo object.
stringdata – A LnkStringData object.
extradata – A LnkExtraData object.
- property clsid: uuid.UUID#
Returns the class id (clsid) of the LNK file.
- flag(name: str) int #
Retuns whether supplied flag is set.
- Parameters:
name – Name of the flag
- Returns:
>0 if flag is set
- Return type:
int
- __repr__() str #
Return repr(self).