{"provider_name":"Hatena Blog","height":"190","provider_url":"https://hatena.blog","author_url":"https://blog.hatena.ne.jp/hideakii/","blog_url":"https://port139.hatenablog.com/","published":"2014-07-10 06:30:41","image_url":null,"author_name":"hideakii","type":"rich","title":"SANS \u30dd\u30b9\u30bf\u30fc\uff1aWindows Artifact Analysis(31) Jump Lists","url":"https://port139.hatenablog.com/entry/2014/07/10/063041","width":"100%","description":"LinkInfo\u69cb\u9020\u306e\u5185\u5bb9\u3092\u78ba\u8a8d\u3057\u3066\u307f\u307e\u3059\u3002\uff08MS-SHLINK \u306e Page 15\uff09\u5148\u982d4\u30d0\u30a4\u30c8\u304cLinkInfoSize\u3067\u3059\u306e\u3067\u3001\u4e0b\u8a18\u3067\u306f 7F 00 00 00 \u3068\u3044\u3046\u5024\u304b\u3089 128byte\u5206\u306e\u30c7\u30fc\u30bf\u7bc4\u56f2\u3092\u629c\u7c8b\u3057\u3066\u3044\u307e\u3059\u3002 7F 00 00 00 1C 00 00 00 01 00 00 00 1C 00 00 002D 00 00 00 00 00 00 00 7E 00 00 00 11 00 00 0003 00 00 00 FD 7B EA 05 10 00 00 00 00 43 3A 5C55 73 65 72 73 5C 68 68 68 68 68 68 5C 41 70\u2026","blog_title":"@port139 Blog","version":"1.0","html":"<iframe src=\"https://hatenablog-parts.com/embed?url=https%3A%2F%2Fport139.hatenablog.com%2Fentry%2F2014%2F07%2F10%2F063041\" title=\"SANS \u30dd\u30b9\u30bf\u30fc\uff1aWindows Artifact Analysis(31) Jump Lists - @port139 Blog\" class=\"embed-card embed-blogcard\" scrolling=\"no\" frameborder=\"0\" style=\"display: block; width: 100%; height: 190px; max-width: 500px; margin: 10px 0px;\"></iframe>","categories":["\u30d5\u30a9\u30ec\u30f3\u30b8\u30c3\u30af"]}