E01 LNK MCP Server for Digital Forensics

Provides LNK artifact extraction, parsing, and DFIR-oriented analysis from E01 disk images via MCP.

python

0

GitHub Stars

python

Language

6 months ago

First Indexed

3 months ago

Catalog Refreshed

Documentation & install

Readme and setup notes from the catalogue, plus a client-ready config you can copy for your MCP host.

Installation

Add the following to your MCP client configuration file.

Configuration

View docs

{
  "mcpServers": {
    "hoihosick-lnk_mcp_server": {
      "command": "C:\\Path\\To\\Your\\.venv\\Scripts\\python.exe",
      "args": [
        "C:\\Path\\To\\Your\\e01_lnk_mcp_server.py"
      ]
    }
  }
}

You deploy the E01 LNK MCP Server to analyze Windows LNK artifacts from E01 disk images. It integrates with MCP clients to perform targeted extraction and parsing of LNK files, enabling DFIR workflows through automated analysis and timeline capabilities.

How to use

To use the LNK MCP Server, configure your MCP client to route analysis tasks to the server. The server exposes five analysis tools that you can trigger via the MCP client: searching for all LNK files, extracting a specific LNK by inode, parsing LNK metadata in detail, performing automated extraction and parsing with a DFIR summary, and generating a timeline of LNK events.

Enable the server by wiring it into your client configuration. The following client configuration snippet shows how to connect to the local MCP server that runs the Python script inside your Python virtual environment.

{
  "mcpServers": {
    "lnk_forensics": {
      "command": "C:\\Path\\To\\Your\\.venv\\Scripts\\python.exe",
      "args": [
        "C:\\Path\\To\\Your\\e01_lnk_mcp_server.py"
      ]
    }
  }
}

How to install

Prerequisites: you will need Python 3.12 and the uv tool for environment management.

Ensure Python 3.12 is installed and available in your path.
Create a Python 3.12 virtual environment using uv.

uv python install 3.12
uv venv .venv --python 3.12
.venv\Scripts\activate

Install dependencies to ensure compatibility with pytsk3 and libewf.

uv pip install -r requirements.txt

Additional content

Notes and cautions you should observe when using this server.

Python version compatibility: the wheel files for pytsk3 in requirements.txt are intended for Python 3.12. If you use a different Python version, replace the wheel link with a matching one for that version.

Available tools

scan_lnk_in_e01

Searches for all LNK files within the E01 container to locate artifacts for further analysis.

extract_lnk_by_inode

Extracts a specific LNK file identified by its inode for detailed examination or manual analysis.

parse_lnk

Parses LNK metadata in detail to reveal target paths, timestamps, and icon/volume information.

auto_extract_and_parse_lnk

Automatically searches, extracts, and parses LNK files to produce a DFIR summary of findings.

extract_lnk_timeline

Generates a timeline of LNK-related events to support chronological analysis.