Support parsing remaining LNK format
puffyCid opened this issue · comments
What new feature do you think would be cool to add to artemis?
Currently artemis supports most of the LNK file format. However, there are a few extra blocks of the format we do not support. While these blocks may not be super useful, we should still support them.
Describe the solution you'd like
Support the remaining parts of the LNK file format.
Additional context
Extra blocks we need to support:
- Console properties
- Console codepages
- Darwin properties
- Known folder location
- Property store
- Shim layer properties
- Special folder location
- ShelItem identifiers list properties
LNK file format: https://github.com/libyal/liblnk/blob/main/documentation/Windows%20Shortcut%20File%20(LNK)%20format.asciidoc
Many of the extra blocks are uncommon, so using LNK files at: https://github.com/AndrewRathbun/DFIRArtifactMuseum may be required.
Pretty sure zimmermans LECmd tool (https://ericzimmerman.github.io/#!index.md) can parse the full format. Would be a good tool to compare against