Grok-LNK is an NTFS file system analysis tool.

Simply point Grok-LNK to the root of a mounted NTFS file system (can be mounted read-only) and Grok-LNK will examine all the link files and provide the user with a tab delimited list of the links, the targets and their attributes.

Link files that reside within system restore points may be of particular interest to Forensic Examiners.

By combining Grok-LNK with SmartMount, Grok-LNK can examine ExpertWitness / Encase format E01 files, raw dd images, Virtual Disk images, FTK images and many others.