0

I know that Windows 7 (Registry) stores the shares that a machine has connected to. Can anybody tell me what the registry location is ?

According to : Forensic Focus, it should be under

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion

but its not here. Help is appreciated. Thanks

2 Answers 2

1

There's some stuff under HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2 that looks promising.

Sorry, my Win7 machine hasn't been on very many network shares in it's lifetime but I think they are all there, thought some are just GUIDs.

1

Try looking under HKEY_CURRENT_USER\Network that will show you the current mapped network drives for the current user based on the drive letter. Or HKEY_Users\<sid>\Network for a particular user (based on the SID).

While my answer will show what drives a user has mapped to a drive letter, adric's will show you the drives accessed that were not mapped to a drive letter (via UNC, etc).

Same path concept applies:

Current User:

HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPounts2 

Specific User (by SID):

HKU\<SID>\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPounts2 

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .