Tags: image forensic

Rating: 4.0

## Pt. 2

In this part, we need to find the MD5 hash of the associated LNK File... I attempted to create it myself but realized that there is information inside LNK files, that we cannot know.I was on the verge of giving up and thought that maybe not all of the files got exported... I used FTK Imager once again to export a list of all files as inside the image as .csv...

Works!

With the help of STRG+F I searched for "ScreenSketch" and there were actually some weirdly named lnk files inside!
csv