Windows shell link (.lnk)
.lnk file signature | application/octet-stream
Windows shell link (shortcut) file. See alsoThe Meaning of Linkfiles in Forensic ExaminationsandEvidentiary Value of Link Files.
Magic Bytes
Offset 0
4B 57 41 4A 88 F0 27 D1
Sources: Gary Kessler
All Known Signatures
2 signature variants are documented for .lnk files across multiple sources.
| Hex Signature | Offset | Sources |
|---|---|---|
| 4B 57 41 4A 88 F0 27 D1 | 0 | Gary Kessler |
| 4C 00 00 00 01 14 02 00 | 0 | Gary Kessler |
Extension
.lnk
MIME Type
application/octet-stream
Byte Offset
0
Risk Level
Safe
Validation Code
How to validate .lnk files in Python
def is_lnk(file_path: str) -> bool:
"""Check if file is a valid LNK by magic bytes."""
signature = bytes([0x4B, 0x57, 0x41, 0x4A, 0x88, 0xF0, 0x27, 0xD1])
with open(file_path, "rb") as f:
return f.read(8) == signatureHow to validate .lnk files in Node.js
function isLNK(buffer: Buffer): boolean {
const signature = Buffer.from([0x4B, 0x57, 0x41, 0x4A, 0x88, 0xF0, 0x27, 0xD1]);
return buffer.subarray(0, 8).equals(signature);
}How to validate .lnk files in Go
func IsLNK(data []byte) bool {
signature := []byte{0x4B, 0x57, 0x41, 0x4A, 0x88, 0xF0, 0x27, 0xD1}
if len(data) < 8 {
return false
}
return bytes.Equal(data[:8], signature)
}API Endpoint
/api/v1/lnk
curl https://filesignature.org/api/v1/lnk
See the full API documentation for all endpoints and parameters.
Frequently Asked Questions
What is a .lnk file?
A .lnk file is a Windows shell link file. Windows shell link (shortcut) file. See alsoThe Meaning of Linkfiles in Forensic ExaminationsandEvidentiary Value of Link Files.
What are the magic bytes for .lnk files?
The magic bytes for Windows shell link files are 4B 57 41 4A 88 F0 27 D1 at byte offset 0. These bytes uniquely identify the file format regardless of the file extension.
How do I validate a .lnk file?
To validate a .lnk file, read the first bytes of the file and compare them against the known magic bytes (4B 57 41 4A 88 F0 27 D1) at offset 0. This is more reliable than checking the file extension alone, as extensions can be renamed.
What is the MIME type for .lnk files?
There is no officially registered MIME type for .lnk files. Systems typically use application/octet-stream as a generic fallback when handling this format.
Is it safe to open .lnk files?
Windows shell link (.lnk) files are generally safe to open. They are classified as low risk because they primarily contain data rather than executable code. However, always ensure files come from a trusted source.