Windows Shortcut File (.LNK)

Quick facts

Extension

.lnk

Format

Windows Shortcut File

Category

system

MIME type

Unknown

Standard / developer

Microsoft

Open with

Windows File Explorer (shortcut properties)

What is LNK?

LNK uses the Shell Link binary structure documented by Microsoft. It stores information for locating and opening a target rather than storing a copy of the target document. A shortcut's icon and displayed name do not establish what it will launch.

How to open LNK

Properties is a metadata view, not a safe sandbox or proof that all launch arguments are visible.

Common uses and compatibility

• Provide a shortcut to a local or network object or launch an application with stored settings.

Things to check

• Moving a shortcut to another computer does not transfer the target file or installed application.
• Stored launch arguments can affect what a program does; an expected icon is not proof of a safe destination.
• Explorer may request a remote icon when displaying a shortcut, and its Properties view can hide parts of launch arguments. Viewing properties does not prove that an unfamiliar shortcut is safe.

Technical details

Signature

Unknown

Encoding

Unknown

Container

Windows Shell Link binary structure

Compression

Unknown

Shell Link (.LNK) Binary File Format

Can I inspect an LNK file without launching its target?

For a shortcut from a known source, Properties can show target metadata. It is not a safety check: Windows can request remote icon resources while displaying shortcuts, and the Properties field may not show all arguments. Keep suspicious attachments out of normal Explorer preview workflows.

1. For a known shortcut, use Properties to review its displayed target and working location without activating it.
2. Do not rely on the displayed target as a complete account of the launch arguments.
3. If the shortcut is unexpected, obtain the original document from a trusted source or ask your security team to inspect it.

Sources: Microsoft: Shell Links · Acronis Threat Research Unit: LNK network requests and hidden launch arguments

LNK vs URL: are they the same shortcut?

No. LNK is the binary Shell Link format for Windows objects and launch settings. URL is the separate Internet Shortcut mechanism for a URL destination. Renaming either file does not translate its structure.

Sources: Microsoft: Shell Link (.LNK) binary specification · Microsoft: Internet Shortcuts

Why does my shortcut stop working after I move it?

The shortcut refers to another object; it is not that object's contents. Windows may attempt to resolve a moved target, but the referenced application, drive or network resource still needs to be available. Ask the source for the real file when a shortcut alone was shared.

Sources: Microsoft: Shell Links

Can I convert an LNK file to PDF or another document?

An LNK file does not contain the target document. Obtain and open a trusted original in its own application before exporting it. Renaming the shortcut to .pdf or .jpg cannot reconstruct the referenced content.

Sources: Microsoft: Shell Links

Can a text editor read the LNK format?

Microsoft specifies a binary format, so opening it as plain text is not a reliable way to inspect every target and argument. The public specification is useful for parser developers, but this page does not claim that the site's file analyzer parses LNK structures.

Sources: Microsoft: Shell Link (.LNK) binary specification

Related formats

• Internet Shortcut

  A text Internet Shortcut stores a URL rather than using the Shell Link binary format.

• VBScript File

  A shortcut can launch a script host; inspect scripts without running unfamiliar code.

• Windows Executable File — Scope

  A shortcut may point to a Windows executable, but inspecting the shortcut is different from launching the target.