This utility will decode Internet Shortcut (*.URL) files to allow you to compare the Shortcut Description with the actual link. It will also decode the Modified time and date.
 
The software can be run as an External Viewer within Encase, iLook or any forensic application that supports external viewers. It has also been designed to accept data from Encase by sending data via the command line.
 
In the command line section when setting up as an external viewer - use the following syntax - please copy and paste exactly as it is below:
 
[file] "FULLPATH=[FullPath]"
 
This will allow Encase to pass the Original Full Path within your evidence file back to the software so this can be shown in the extraction.
 
You can then paste the decoded information back into a note or bookmark - to be viewed in your forensic report!
 
The software will also accept drag and drop multiple files - doing it this way allows you to copy out ALL of the *.url files from your case and examine them all at once - thereby identifying any links which have been wrongly described in an attempt to hide the true link.