What is the LNK file format?
.lnk files are the shortcut files used in the Windows system. They contain information about the type and location of the target - identified by a local path, UNC share, or Shell Item ID list - and about the associated program.
.lnk files may contain additional, user-defined information. If they are associated with an .exe application, they can also indicate initial startup attributes for the program they refer to, such as window state, working directory, and command-line arguments. In Windows, .lnk files display the same icon as their target file. The .lnk extension is hidden in the filename by default and does not appear in File Explorer.
The binary format is documented by Microsoft as the MS-SHLLINK specification (published 2010). Every .lnk file opens with a fixed 76-byte header: magic bytes 4C 00 00 00 followed by the fixed shell link class CLSID. Related shortcut formats include .url (internet shortcut) and .pif (legacy DOS program shortcut).
When an .lnk shortcut stops working
Changing some parameters of the target file - such as its name or location - results in disabling all shortcut files that lead to it. Changes to drive letters or network share mappings can also cause desktop shortcuts to disappear. Windows includes a link-tracking service that attempts to repair broken shortcuts automatically; when it fails, re-creating the shortcut or updating the target path via the *Properties* dialog is the recommended fix.
Security & safety
RISK: HIGHLNK is one of the most abused initial-access formats on Windows. A shortcut can silently launch cmd/PowerShell with attacker-controlled arguments and a disguised icon (PDF, folder); since Microsoft blocked internet Office macros in 2022, LNK inside ZIP/ISO e-mail attachments became a primary malware vector. Historic LNK flaws include CVE-2010-2568 (Stuxnet, icon-parsing code execution) and ZDI-CAN-25373 / CVE-2025-9491 - whitespace-padded arguments hiding the real command in the Properties dialog, exploited by 11+ state-sponsored groups since ~2017 and patched by Microsoft only in the November 2025 updates. Rules for users: never double-click a .lnk that arrived by e-mail/USB, inspect it with LECmd/ExifTool instead, and keep Windows updated. 'Shortcut virus' on USB drives hides folders and replaces them with malicious shortcuts - clean with an AV scan plus attrib, don't just delete the links.
Format details
in a nutshellPrograms that open LNK files
Windows3 apps
Microsoft Windows (File Explorer)
Built-in Double-click runs the target. Right-click → Properties shows the Target field; 'Open file location' jumps to the real file. To repair a broken .lnk association, delete HKCU\...\FileExts\.lnk\UserChoice and restart Explorer.
LECmd (Eric Zimmerman)
Free Command line: LECmd.exe -f file.lnk - dumps full metadata (target, timestamps, machine ID) without executing anything; forensic standard.
ExifTool
Open-source exiftool file.lnk prints target path, arguments and machine metadata safely (no execution); also works on macOS/Linux. 
macOS1 app
ExifTool
Open-source exiftool file.lnk shows the Windows target path - useful when a .lnk arrived instead of the real document. 
Linux2 apps
liblnk (lnkinfo)
Open-source Install liblnk-utils, then lnkinfo file.lnk to inspect the shortcut's target and metadata. Technical details
deep spec| Container type | Fixed-length binary header (76 bytes) followed by variable-length optional data blocks |
| Magic bytes | 4C 00 00 00 01 14 02 00 … C0 00 … 46 - first 4 bytes encode the header size; bytes 4-19 hold the fixed shell link class CLSID, both at offset 0 |
| MIME type | application/x-ms-shortcut |
| Byte order | Little-endian throughout all numeric fields |
| String encoding | Code-page (ANSI) or Unicode (UTF-16 LE); a flag in ShellLinkHeader indicates which encoding is present |
| Target reference types | Local file or folder path, UNC network path, volume root, or environment-variable-expanded path via EnvironmentVariableDataBlock |
| Key data structures | ShellLinkHeader, LinkTargetIDList (ITEMIDLIST), LinkInfo, StringData blocks, ExtraData blocks - all optional except the header |
| Window state field | ShowCommand in the header: 1 = Normal, 3 = Maximized, 7 = Minimized |
| Hotkey field | 16-bit value in the header combining a VirtualKey code with modifier flags (Shift, Ctrl, Alt) |
| Relative path support | Optional RelativePath string allows the Windows shell to self-repair a broken shortcut when the target is moved within the same volume |
| Embedded target timestamps | FileTime values for target creation, last write, and last access are stored in LinkInfo, making .lnk files valuable artifacts in digital forensics |
| Icon storage | Separate IconLocation path string plus an integer IconIndex pointing to the icon resource within that file |
| Extension visibility | Hidden by Windows shell by default; controlled by the HideFileExt value under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced |
| Security history | Exploited by Stuxnet (CVE-2010-2568): malicious .lnk files triggered code execution at icon-render time; patched in MS10-046 (August 2010) |
| Platform support | Native to Windows 95 and all later Windows versions; parseable on Linux and macOS via liblnk (lnkinfo) and ExifTool |
| Released | 1995 (Windows 95); binary format publicly documented since 2010 as MS-SHLLINK |
| Open standard | Yes · royalty-free |
| Specification | learn.microsoft.com |
LNK conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about LNK files.
