Read What a Windows Shortcut Remembers SHORTCUT
A Windows shortcut is a small binary record. It remembers the file's original path, the file's own dates, the serial of the drive it was on, and the name and MAC address of the machine that made the shortcut.
1. The shortcut
A .lnk from anywhere: a shortcut on the desktop, or one out of a user's Recent folder or an automatic jump list. It is read here and never written to.
%AppData%\Microsoft\Windows\Recent. Nothing is uploaded.
No shortcut open yet.
2. What it remembers
What this reads, and what to do with it
Every field above is read straight from the bytes of the Shell Link format. The path, the drive serial and the creating machine survive the target being deleted and the drive being removed, which is what makes a shortcut worth reading. But it is one artefact: the dates can be wrong if the clock was, a shortcut can be copied from another machine, and absence proves little. Hash the copy with CHECKSUM, record where it came from with CHAIN, and corroborate against the registry and the event logs before it carries any weight.