Workflows - LNK and Jump List Analysis

# Workflows - LNK and Jump List Analysis

## Workflow 1: User File Access Investigation
```
Collect LNK files from Recent directory
    |
Parse with LECmd to CSV
    |
Filter by target path for specific files/locations
    |
Extract timestamps, volume serial, NetBIOS name
    |
Correlate with MFT and Event Log timestamps
    |
Document file access timeline
```

## Workflow 2: Jump List Application Activity
```
Collect AutomaticDestinations and CustomDestinations
    |
Parse with JLECmd to CSV
    |
Map AppID hashes to applications
    |