LNK file analysis with EnCase forensic
In our previous recipes, you have already learnt how to create a new case, add evidence files, and examine Windows recycle bin contents with EnCase Forensic. Now it's time to go even further, and meet the EnCase Evidence Processor, and especially the Windows Artifact Parser. This module enables a digital forensic examiner to parse different Windows forensic artifacts, including LNK files, automatically.
Getting ready
To use the EnCase Evidence Processor, you should create a case and add an evidence item. You already created a case to examine the recycle bin, so you can use that case here. If it's not available, create a new one and add an image to it. Once done, you are ready to use the EnCase Evidence Processor and the Windows Artifact Parser.
How to do it...
The steps for LNK files analysis are given as follows:
- Once you have created a new case and added an evidence item, go to
Process Evidence-Process...You will see theEnCase Processor Optionswindow...
