Lnk

Shortcut files linking to application, files and folders

%USERNAME%\AppData\Roaming\Microsoft\Windows\Recent\
\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Recent\*.lnk

%SystemDrive%:\Users\<USERNAME>\Desktop
\Users\<USERNAME>\AppData\Roaming\Microsoft\Office\Recent\*.lnk

\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp
\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

Shortcut files (*.lnk) are Windows Shell Items that reference to an original file, folder, or application. The effect of double-clicking a shortcut file is intended to be the same as double-clicking the application or file to which it refers. In addition, command line parameters and the folder in which the target should be opened can be specified in the shortcut. The shortcut files have a magic number of 0x4C (4C 00 00 00).

Parse:

Eric Zimmermans tool LECmd.exe

# Parses the     specified shortcut file.
LECmd.exe [-q --csv <CSV_DIRECTORY_OUTPUT>] -f <LNK_FILE>

# Recursively retrieves and parses the shortcut files in the specified directory.
LECmd.exe [-q --csv <CSV_DIRECTORY_OUTPUT>] -d <C:\Users\<USERNAME>\AppData\Roaming\Microsoft\Windows\Recent\ | C:\ | DIRECTORY>