Skip to content

Windows shell link (.lnk)

.lnk file signature | application/octet-stream

Windows Shell Link (LNK) is a shortcut file format created by Microsoft for the Windows operating system and maintained as part of the Windows shell. It is used to point to programs, documents, folders, and network resources, and is commonly generated by the desktop, Start menu, and File Explorer. LNK files are generally safe, but they may record access paths and can be abused in malicious shortcuts or forensic investigations.

Safe

Magic Bytes

Offset 0
4C 00 00 00 01 14 02 00

Sources: Gary Kessler

Extension

.lnk

MIME Type

application/octet-stream

Byte Offset

0

Risk Level

Safe

Validation Code

How to validate .lnk files in Python

Python 
def is_lnk(file_path: str) -> bool:
    """Check if file is a valid LNK by magic bytes."""
    signature = bytes([0x4C, 0x00, 0x00, 0x00, 0x01, 0x14, 0x02, 0x00])
    with open(file_path, "rb") as f:
        return f.read(8) == signature

How to validate .lnk files in Node.js

Node.js 
function isLNK(buffer: Buffer): boolean {
  const signature = Buffer.from([0x4C, 0x00, 0x00, 0x00, 0x01, 0x14, 0x02, 0x00]);
  return buffer.subarray(0, 8).equals(signature);
}

How to validate .lnk files in Go

Go 
func IsLNK(data []byte) bool {
    signature := []byte{0x4C, 0x00, 0x00, 0x00, 0x01, 0x14, 0x02, 0x00}
    if len(data) < 8 {
        return false
    }
    return bytes.Equal(data[:8], signature)
}

API Endpoint

GET /api/v1/lnk
curl https://filesignature.org/api/v1/lnk

See the full API documentation for all endpoints and parameters.

Frequently Asked Questions

What is a .lnk file?

A .lnk file is a Windows shell link file. Windows Shell Link (LNK) is a shortcut file format created by Microsoft for the Windows operating system and maintained as part of the Windows shell. It is used to point to programs, documents, folders, and network resources, and is commonly generated by the desktop, Start menu, and File Explorer. LNK files are generally safe, but they may record access paths and can be abused in malicious shortcuts or forensic investigations.

What are the magic bytes for .lnk files?

The magic bytes for Windows shell link files are 4C 00 00 00 01 14 02 00 at byte offset 0. These bytes uniquely identify the file format regardless of the file extension.

How do I validate a .lnk file?

To validate a .lnk file, read the first bytes of the file and compare them against the known magic bytes (4C 00 00 00 01 14 02 00) at offset 0. This is more reliable than checking the file extension alone, as extensions can be renamed.

What is the MIME type for .lnk files?

There is no officially registered MIME type for .lnk files. Systems typically use application/octet-stream as a generic fallback when handling this format.

Is it safe to open .lnk files?

Windows shell link (.lnk) files are generally safe to open. They are classified as low risk because they primarily contain data rather than executable code. However, always ensure files come from a trusted source.