CHFI OS and Network Forensics Practice Question
During a Windows forensic analysis, you find a suspicious LNK file in a user's Recent folder. Which of the following is NOT typically retrievable from an LNK file?
⚠ Common exam trap
EC-Council CHFI often tests the misconception that LNK files store the creator's username because they associate the file with a user's Recent folder, but the username is derived from the folder path, not the file's internal data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Username of the user who created the LNK file
LNK files store metadata about the target file and the system environment, but they do not record the username of the user who created the LNK file. The creation timestamp of the LNK file itself is stored, but the username is not part of the LNK file structure. Instead, the username context is inferred from the user's profile folder path where the LNK resides, not from the file's internal data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Username of the user who created the LNK file
Why this is correct
The Shell Link binary format has no dedicated field for the creating user's username or SID. LNK files identify the machine via the MachineID string and the target volume via a serial number, but attribution to a specific account must be reconstructed through indirect evidence like the NTFS USN journal, Prefetch, or shellbags, not read directly from the .lnk file.
- ✗
Target file creation timestamp
Why it's wrong here
LNK files store three target-file timestamps in the header of the LinkTargetInfo structure: CreationTime, AccessTime, and WriteTime (all FILETIME UTC values). This is a core feature of the format, so a target file's creation timestamp is explicitly preserved in the artifact, making it an incorrect choice for data that is absent from an LNK file.
- ✗
Volume serial number of the target drive
Why it's wrong here
The VolumeID structure inside the LNK's LinkInfo contains a VolumeSerialNumber, a 32-bit value representing the NTFS or FAT volume serial of the drive where the target resides. This field is mandatory for local absolute paths, so a forensic examiner can reliably extract the target drive's serial number directly from the .lnk file, meaning it is not missing data.
- ✗
Target file path
Why it's wrong here
Every LNK file contains a LinkTargetIDList and an associated LinkInfo string block that records the target's absolute path, relative path, and common path. Because path reconstruction is the central purpose of a shortcut, the target file path is always present (unless corrupted), so this option does not represent a piece of data absent from the LNK.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.