lnk listing · mft or userassist · access without Recent LNK · clearing detection · deleted targets · runs locally
sources
drop LECmd · Recent listing · MFT · UserAssist · 4663
or click
sparse Recent folder · document access without shell link · deleted LNK targets · foreign machine ID · USB paths
drop LNK listing or LECmd csv · MFT · UserAssist · 4663/4688 events