Windows Registry

A hierarchical database that stores all the required information for the OS and installed software to run.

It is divided into data that is:

• User-specific
• Computer-specific

The system registry can be found C:\Windows\System32\Config\. The user-specific registry hive is stored in C:\Users\<USERNAME>\Ntuser.dat

It can be opened with regedit from CMD or PowerShell.

Organisation

The registry is organised as a tree-structure that stores keys and values.

Keys

It has main-folders (root keys) in which sub-folders (subkeys) with their entries/files are located. The top level is called Computer and each folder under is a key.

The root keys all start with HKEY. The root key contains six subkeys:

• SAM
• SECURITY
• SYSTEM
• SOFTWARE
• HARDWARE
• BCD

These are loaded into memory at boot time except HARDWARE which is dynamically loaded.

Values

Values are data in the form of objects that relates to a specific key.

They consist of:

• Name
• Type Specification
• Data

Registry Hives

A hive is the top-level section of the registry that is loaded into memory as a single file on disk.

Windows has the following hives:

• HKEY_LOCAL_MACHINE (HKLM): contains information about the computer’s physical state, such as hardware and operating system data, bus types, memory, device drivers, and more.
• HKEY_CURRENT_CONFIG (HKCC): contains records for the host’s current hardware profile.
• HKEY_CLASSES_ROOT (HKCR): File type information, UI extensions, and backward compatibility settings are defined here.
• HKEY_CURRENT_USER (HKCU): specific OS and software settings for each specific user, e.g. roaming profile settings and user preferences.
• HKEY_USERS (HKU): Contain the default User profile and current user configuration settings for the local computer