dissect.shellitem.lnk.lnk

Module Contents

Classes

LnkExtraData

Class that represents the a LNK file's EXTRA_DATA structure

LnkStringData

This class represents the LNK file's STING_DATA structure. The STRING_DATA structure refers to a set of

LnkInfo

This class represents a LNK file's LINK_INFO structure. The optional LINK_INFO structure specifies information

LnkTargetIdList

This class represents a LNK file's TARGET_IDLIST structure. The TARGET_IDLIST structure specifies the target of

Lnk

This class represents a LNK file's SHELL_LINK_HEADER, and the remainder of the parsed LNK file structures.

Attributes

log

dissect.shellitem.lnk.lnk.log
class dissect.shellitem.lnk.lnk.LnkExtraData(fh: BinaryIO | None = None)

Class that represents the a LNK file’s EXTRA_DATA structure This optional structure hold additional optional structures that convey additional information about a link target

Parameters:

fh – A file-like object to an EXTRA_DATA structure

extradata
__getattr__(attr: str) → Any
__repr__() → str
class dissect.shellitem.lnk.lnk.LnkStringData(fh: BinaryIO | None = None, lnk_flags: dissect.shellitem.lnk.c_lnk.c_lnk.LINK_FLAGS | None = None)

This class represents the LNK file’s STING_DATA structure. The STRING_DATA structure refers to a set of structures that convey user interface and path identification information.

STRING_DATA = [NAME_STRING] [RELATIVE_PATH] [WORKING_DIR] [COMMAND_LINE_ARGUMENTS] [ICON_LOCATION]

Parameters:

  • fh – A file-lke object to a STRING_DATA structure

  • lnk_flags – Parsed LINK_HEADER flags

flags = None
string_data = None
__getattr__(attr: str) → Any
__repr__() → str
class dissect.shellitem.lnk.lnk.LnkInfo(fh: BinaryIO | None = None)

This class represents a LNK file’s LINK_INFO structure. The optional LINK_INFO structure specifies information necessary to resolve a link target if it is not found in its original location. This includes information about the volume that the target was stored on, the mapped drive letter, and a UNC path if existed when the link was created.

Parameters:

fh – A file-like objet to a LINK_INFO structure

fh = None
flags = None
size = None
linkinfo_header = None
linkinfo_body = None
flag(name: str) → int

Returns whether supplied flag is set.

Parameters:

name – Name of the flag

Returns:

>0 if flag is set

Return type:

int

__getattr__(attr: str) → Any
__repr__() → str
class dissect.shellitem.lnk.lnk.LnkTargetIdList(fh: BinaryIO | None = None, size: int | None = None)

This class represents a LNK file’s TARGET_IDLIST structure. The TARGET_IDLIST structure specifies the target of the link. This information is stored in individual ITEM_ID structures.

Parameters:

  • fh – A file-like object to a TARGET_IDLIST structure.

  • size – Size of the TARGET_IDLIST structure

target_idlist = None
idlist = None
size = None
__repr__() → str
class dissect.shellitem.lnk.lnk.Lnk(fh: io.BufferedReader, target_idlist: LnkTargetIdList | None = None, linkinfo: LnkInfo | None = None, stringdata: LnkStringData | None = None, extradata: LnkExtraData | None = None)

This class represents a LNK file’s SHELL_LINK_HEADER, and the remainder of the parsed LNK file structures. This SHELL_LINK_HEADER structure contains identification information, timestamps, and flags that specify the presence of optional structures.

Parses a .lnk file (aka Microsoft Shell Item) according to the MS-SHLLINK specification reference: https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-SHLLINK/%5bMS-SHLLINK%5d.pdf

Parameters:

  • path – (string) Path to a link file.

  • target_idlist – A LnkTargetIdList object.

  • linkinfo – A LnkInfo object.

  • stringdata – A LnkStringData object.

  • extradata – A LnkExtraData object.

fh
flags = None
target_idlist
linkinfo
stringdata
extradata
flag(name: str) → int

Returns whether supplied flag is set.

Parameters:

name – Name of the flag

Returns:

>0 if flag is set

Return type:

int

property clsid: uuid.UUID

Returns the class id (clsid) of the LNK file.

__repr__() → str