How does link file gives information about remote/local execution? According to me(and LECmd, etc tools), lnk file gives information abut file/folder opening only(along with information about the volume and MAC address ). Can you please elaborate on this point.