.lnk · application/x-ms-shortcut
What is a .lnk file?
Windows Shortcut
About the format
A .lnk file is a Windows shell shortcut: a small binary file (Shell Link format) pointing at a target — a program, document, folder or command line — along with the icon, working directory, hotkey and window state to use. Explorer hides the .lnk extension even when 'show extensions' is on, which attackers have long abused: a file named 'invoice.pdf.lnk' displays as 'invoice.pdf' with whatever icon it likes, while its target silently runs PowerShell with a malicious command line. That command-line field is the thing to inspect on any shortcut you didn't create: right-click → Properties shows the Target, and anything invoking powershell, cmd /c, mshta or wscript from a shortcut that pretends to be a document is a red flag. Forensically, shortcuts are also breadcrumbs — Windows creates them automatically in the Recent folder for every file you open, recording paths and timestamps.
How to open a .lnk file
Windows
- Explorer (runs the target)
- Properties dialog (inspect the target)
- LECmd (forensic parser)
macOS
- lnk parsers (forensic tools)
Linux
- lnkinfo (liblnk)
Is a .lnk file dangerous?
Indirectly, yes. The shortcut itself is data, but its target line can launch anything. Inspect shortcuts from email or downloads before double-clicking — malware distribution via .lnk is common.
Related file types
Not sure what a file is? Check its bytes.
File names lie; magic numbers don't. Drop any file into the identifier — nothing is uploaded.
Identify a file →