File:
<SYSTEMDRIVE>:\Users\<USERNAME>\NTUSER.dat.
Registry key:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU
<SYSTEMDRIVE>:\Users\<USERNAME>\NTUSER.dat.
Registry key:
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Map Network Drive MRU
Overview
The Map Network Drive MRU registry key references the network shares recently
used by the associated user. The network share do not have to be persistently
mapped to be referenced by the Map Network Drive MRU key.
Information of interest
Each network share is stored in a dedicated value under the
Map Network Drive MRU key. The value data contains the UNC path of the
network share (such as <IP | HOSTNAME>\<SHARE_NAME>).
The values are ordered in a Most recently used (MRU) list, specified in the
MRUList value. Example: MRUList equals to ba means that the entry tagged
as b was accessed last / the most recently, preceded by the entry tagged as
a.
The last write timestamp of the key indicates the timestamp of the most recently accessed share.
References
View on GitHub