Tags: image forensic
Rating: 4.0
## Pt. 2
In this part, we need to find the MD5 hash of the associated LNK File... I attempted to create it myself but realized that there is information inside LNK files, that we cannot know.I was on the verge of giving up and thought that maybe not all of the files got exported... I used FTK Imager once again to export a list of all files as inside the image as .csv...
Works!
With the help of `STRG+F` I searched for "ScreenSketch" and there were actually some weirdly named lnk files inside!
```csv
ef6024630ca7a7601a83ecb5af634ce6,"d66260224de3d30616b765dcaddbb6c803b8e8ec","ScreenShot.ad1\E:\ScreenShot\ScreenShot [AD1]\Users\0xSh3rl0ck\AppData\Roaming\Microsoft\Windows\Recent\ms-screensketcheditisTemporary=true&source=screenclip&sharedAccessToken=0CFD1BEB-8309-414C-80D1-8F7D1132DA56&secondarySharedAccessToken=0557B721-9B6F-4EED-8FCC-0523E30625B5&viewId=-198227.lnk"
```
It even includes the MD5 hash of that files. Challenge solved.
*Click the link for images*
