LNK & Jumplist Browser

[Updates]

• Small corrections
• Added support for LNK extension types [BEEF001F] and [BEEF0028]

---

• Undocumented descriptions (FMTID\PID) still missing:

  • [CF5BE8C0-236C-4AD3-BACE-CD608A2748D7\100]
  • [0C570607-0396-43DE-9D61-E321D7DF5026\1]
  • [0C570607-0396-43DE-9D61-E321D7DF5026\2]
  • [0C570607-0396-43DE-9D61-E321D7DF5026\3]
  • [0C570607-0396-43DE-9D61-E321D7DF5026\4]
  • [0C570607-0396-43DE-9D61-E321D7DF5026\5]
  • [0C570607-0396-43DE-9D61-E321D7DF5026\6]
  • [32A166EC-CF45-417F-A96C-48954855C727\2]
  • [77C77E35-1BE3-4350-A48C-7563D727776D\2]
  • [0AE54373-43BE-4FAD-85E4-69DC8633986E\7]
  • [0AE54373-43BE-4FAD-85E4-69DC8633986E\11]
  • [006FDBAA-864F-4D1C-A8E8-E62772E454FE\11]
  • [006FDBAA-864F-4D1C-A8E8-E62772E454FE\13]

---

MD5: 6C9A3DD2546A3B6DBB038456C79215F8
SHA256: E750DA936EBBAB7484FA78F39FF1F0B44E3BF9B6128D3329FF0AE3A92C972ADB

LNK & Jumplist Browser

[Updates]

• Added support for ItemID Type 0x52 related to Acronis *.tib (backup files) opened with Windows Explorer
  (Signature bytes 67B1AC01, 67B1AC02, 67B1AC03) found in [UsrClass] BagMRU

  • 67B1AC01 → backup description with GUID and human‑readable name
  • 67B1AC02 → drive root (repeated for each mount point)
  • 67B1AC03 → folder entry, always an absolute path + a relative name

• extended support for the Augmented Shell Items ( 'AugM' = nested PIDL delegate) found in [UsrClass] BagMRU

  

---

MD5: 59FF8C7C177153D4C4344312880B4866
SHA256: C80583F7B73E1ED1F79F25DE51F0F6723ADDE4810F483C989140A2578916EAFA

LNK & Jumplist Browser

[Updates]

• Improved support for the Augmented Shell Items ( 'AugM' = nested PIDL delegate) , for versions 2 & 4 (different offsets).
  (These are usually found when files on CD-ROMs are accessed ..)

  

• added one more type 0x00 signature for an Autolist entry

• Note: check the example .lnk file in test.Untitled1.rar
  (extracted the lnk from 5f7b5f1e01b83767.automaticDestinations-ms [Quick Access]
  Full target path is D:\websites\Salco\www.salco.dev09.thirdwavellc.com\webroot\development\pdf\test.pdf)
  with other tools to see how they interpret these entries.

---

MD5: 7545691953735E1E8FA0F0AAEE4BE2A2
SHA256: 3A562F80844A34116AD4656B53362A14AECCCC66FE88A03388E5454F93A2D8E8

LNK & Jumplist Browser

[Updates]

• Added another IDList type 0x00 & warning of shortcut/lnk-file-size discrepancy indicating that the lnk shortcut may be malicious:

  
  
  

  • Amended some logic for ANSI/Unicode reading
    -Other minor changes/corrections

---

MD5: 8C1A6A4229C177221ABF9AAE7B9F760F
SHA256: 3D0E2B48021E1E9F14B9E9511CA95AFA770B1A93A76E575D8371E98D5F950FA8

LNK & Jumplist Browser

[Updates]

• Serialized Property Store (1SPS) parsing code restructured
• Changed some logic + added helper functions

---

• Undocumented descriptions (FMTID\PID) still missing:

  • [CF5BE8C0-236C-4AD3-BACE-CD608A2748D7\100]
  • [0C570607-0396-43DE-9D61-E321D7DF5026\1]
  • [0C570607-0396-43DE-9D61-E321D7DF5026\2]
  • [0C570607-0396-43DE-9D61-E321D7DF5026\3]
  • [0C570607-0396-43DE-9D61-E321D7DF5026\4]
  • [0C570607-0396-43DE-9D61-E321D7DF5026\5]
  • [0C570607-0396-43DE-9D61-E321D7DF5026\6]
  • [32A166EC-CF45-417F-A96C-48954855C727\2]
  • [77C77E35-1BE3-4350-A48C-7563D727776D\2]
  • [0AE54373-43BE-4FAD-85E4-69DC8633986E\7]
  • [0AE54373-43BE-4FAD-85E4-69DC8633986E\11]
  • [006FDBAA-864F-4D1C-A8E8-E62772E454FE\11]
  • [006FDBAA-864F-4D1C-A8E8-E62772E454FE\13]

---

MD5: 170974FFB399B54CB884552AF660B709
SHA256: A972456F91EBCDFD320280A0DF39F49D52F9D11229925512338A78A9E424E623

LNK & Jumplist Browser

[Updates]

• Minor corrections & improvements

Note: The .exe is not digitally signed (due to the ridiculous cost of signatures)

---

MD5: 0DDADA700B8CAA321A55CC49816FE863
SHA256: FCC666EAB4414637323C34E567B11979D8F3F538A0BF74B2AEC8ED18639E522F

LNK & Jumplist Browser

[Updates]

• Even more corrections & updates prompted by more variations found during testing & carving,
  such as this:

  

---

MD5: 9A64126AF9858C21DEAA160E067CF026
SHA256: 41EBB765DC9D4F3DADDDCAC6E46C2C401AFED310DF21CB4EBA16AE2EE9A50807

LNK & Jumplist Browser

[Updates]

• Corrections & updates

---

MD5: 0C952ED60F1920A42E6FB59D603F0A0D
SHA256: 466F1040A6115B1CD5DEA7ADA282B8D60FB0D762FABB2CB51EFD1BA2A0C081DD

LNK & Jumplist Browser

[Updates]

• Various improvements & updates including:

  • Added option to save some Nodes to json

  • Expanded option to save the Treeview to json for both trees

  • Added option to carve BEEF0004 itemID extensions (beta)

  • Verification of some of the info contained in ItemIDs:

    

---

MD5: A5EC9823FCD1719FDF1266BC9D79BBC3
SHA256: 344835CC754B09DF10199CB7B434E6D3737F31E15E91EF30F505C47AED414B7F

LNK & Jumplist Browser

[Updates]

• Improvements/corrections in 'automaticDestinations-ms':

  
  

• A few other small corrections & changes

---

MD5: 2CB3707E750D0389CBB82DB4D184F8A5
SHA256: 5E4AA65E2A355BE682649339A5CD9440575122B79F750512FF287EA4AED4904D