mru.networkdrive

$ target-query <path/to/target> -f mru.networkdrive

Details

Module	os.windows.regf.mru.MRUPlugin
Output	records

Module documentation

Return MRU data stored at various registry keys.

The Windows registry contains various keys about Most Recently Used (MRU) files.

References:

• https://winreg-kb.readthedocs.io/en/latest/sources/explorer-keys/Most-recently-used.html

Function documentation

Return MRU of mapped network drives.

The HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerMap Network Drive MRU registry key contains information about the most recently used mapped network drives.

References:

• https://winreg-kb.readthedocs.io/en/latest/sources/explorer-keys/Most-recently-used.html#keys-with-a-mrulist-value