Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Extract specific metadata from LNK files. Make reference to linked file. #2307

Open
patrickdalla opened this issue Aug 23, 2024 · 1 comment
Open

Extract specific metadata from LNK files. Make reference to linked file. #2307

patrickdalla opened this issue Aug 23, 2024 · 1 comment
Labels
enhancement

Comments

@patrickdalla
Copy link
Collaborator

Extracts specific metadata from LNK files, like local path, volumelabel and networkshare.

Also, some info can be used to local the referenced file, and register the reference to in "linkedItems" prop so it is show in References Tab.
patrickdalla added a commit that referenced this issue Aug 23, 2024
@patrickdalla
'#2307 Puts LNKShortcutParser in second queue as it must find the
56fec05 
referenced item to make the reference.
patrickdalla added a commit that referenced this issue Aug 23, 2024
@patrickdalla
'#2307 Creates propery to represent and save mft idx, so it can be used
b5df46e 
to search for items in the case later.
patrickdalla added a commit that referenced this issue Aug 23, 2024
@patrickdalla
'#2307 Adds some info as Metadata to each LNK file parsed, and makes the
3efcc5f 
reference to any correspondent found item in case. The search is first
based on metaAddress (mft idx) and latter, if not successfull, on
relative path, after removing any volume letter info. The creationDate
info is compared to confirm the match.
@patrickdalla
Copy link
Collaborator Author

At first, I found that adding the timestamps of LNK source registered inside LNK would lead in redundancies. But, as we already check if the referenced item exists, we can check if those timestamps coincides, and register only the different ones.

So, if MODDATE inside LNK is different than the correspondent item found MODDATE, it will be added in new metadata, meaning that the source has been modified after its opening through the LNK. Also to access date.
Creation date is already used to confirm the file, as if it have a different creation date it can mean another file with same path/name or mft idx. So if creation date does not match, the item is not considered the source of the LNK, and all source timestamps information are added.

I will push the commits of the above implementation right after final tests.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
enhancement
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@lfcnassif @patrickdalla