Section 5: Registry Files on Disk

The Big Picture: Where the Shelves Are Kept

In Section 2 you learned that the registry is built from hives, and each hive is stored as a file. When Windows is off, the registry is just a few files sitting on the disk. When Windows runs, the kernel loads these files into memory and shows them as the tree you see in regedit.

This section shows you where those files are, what each one holds, and how they are loaded.

WINDOWS OFF                          WINDOWS RUNNING

 files on disk                        tree in memory
 ┌──────────────┐  loaded at boot     HKEY_LOCAL_MACHINE
 │ SYSTEM       │ ───────────────►     ├── SYSTEM
 │ SOFTWARE     │ ───────────────►     ├── SOFTWARE
 │ SAM          │ ───────────────►     └── ...
 │ NTUSER.DAT   │ ─ at sign-in ──►    HKEY_USERS\<your SID>
 └──────────────┘

Important: These files are in use while Windows runs. You cannot open, copy or delete them from File Explorer. If you try, Windows says the file is open in another program. That is a safety feature. You can still copy them safely with the right tools (Section 10).

5.1 Hive Files Location (C:\Windows\System32\config)

What it is: The main machine hive files live in one folder:

C:\Windows\System32\config

(If Windows is on another drive letter, replace C: with that letter. The folder is also reached as %SystemRoot%\System32\config.)

If you look at it (you may need administrator rights, and Windows may ask you to click Continue), you will see files without any extension, and files with extensions like .LOG1 and .LOG2:

C:\Windows\System32\config
 ├── SYSTEM            SYSTEM.LOG1       SYSTEM.LOG2
 ├── SOFTWARE          SOFTWARE.LOG1     SOFTWARE.LOG2
 ├── SAM               SAM.LOG1          SAM.LOG2
 ├── SECURITY          SECURITY.LOG1     SECURITY.LOG2
 ├── DEFAULT           DEFAULT.LOG1      DEFAULT.LOG2
 ├── COMPONENTS        (another hive, used by Windows servicing)
 └── RegBack           (a folder; see Section 10)

What are the .LOG1 and .LOG2 files? They are transaction logs. Before Windows changes the main hive file, it writes a note about the change in a log. If the power fails halfway, Windows can replay the log at the next start and finish the job, so the hive does not end up half-written. Think of a shop assistant who writes each sale in a notebook first, then updates the big ledger. If they are interrupted, the notebook tells them what was left to do.

You may also see files ending in .blf and .regtrans-ms. These belong to a related system for transactional changes and can be ignored.

Windows tip: You can look at the folder's contents in PowerShell without opening the files:

Get-ChildItem C:\Windows\System32\config -Force | Select-Object Name, Length, LastWriteTime

(Run PowerShell as a normal user: you may get "access denied", which is the permission system from Section 6 at work. Use an administrator window only to look, never to delete.)

5.2 SAM, SECURITY, SOFTWARE, SYSTEM, DEFAULT Hives

What they are: The five machine hives, each with one job.

Another hive that matters at boot:

Why SYSTEM comes first. The boot loader (the small program that starts Windows, see Chapter 6) reads SYSTEM very early, before the kernel is fully running, to find out which drivers must be loaded at boot. If SYSTEM is damaged, Windows often cannot start at all.

Protected hives. SAM and SECURITY are locked down so tightly that even an administrator cannot open them in regedit by default. Only the SYSTEM account can. That is deliberate: they hold the keys to your accounts.

Which hives have no file? HKLM\HARDWARE is rebuilt in memory every boot. HKCR and HKCC are views (Section 2). The key HKLM\SYSTEM\CurrentControlSet is a link. None of these has its own file.

5.3 NTUSER.DAT (Per-User Hive)

What it is: Every user has a hive file of their own, called NTUSER.DAT, stored in their profile folder:

C:\Users\Rover\NTUSER.DAT

It holds that user's HKCU data: wallpaper, theme, app preferences, and so on. Beside it you will find ntuser.dat.LOG1 and ntuser.dat.LOG2 (the transaction logs, as in 5.1).

The file is hidden (and protected as a system file). To see it, turn on View → Show → Hidden items in File Explorer. You still cannot copy it while you are signed in, because Windows holds it open.

The second per-user file: UsrClass.dat. Each user also has file association data that belongs only to them (the HKCU\Software\Classes part from Section 2). It lives here:

C:\Users\Rover\AppData\Local\Microsoft\Windows\UsrClass.dat

What a profile hive means for you:

Loading someone else's hive. regedit has File → Load Hive..., which lets an administrator open a hive file of a user who is not signed in, or from another Windows disk. It then appears under a name you choose. Always unload it afterwards (File → Unload Hive). This is an advanced task. Do not try it until you are sure.

5.4 Hive Loading at Boot

What it is: The registry is not "started" by a normal program. It is brought up by the Configuration Manager, a part of the kernel (the Windows Executive; see the boot chapter, Chapter 6, and Chapter 8 Section 7). It is one of the first things the kernel does.

The steps, in order:

1. Boot loader (winload) reads the SYSTEM hive file from disk
        │  It reads just enough to learn which drivers must load at boot
        ▼
2. Kernel starts and the Configuration Manager takes over the SYSTEM hive
        │  (it also builds HKLM\HARDWARE in memory as it finds devices)
        ▼
3. Boot-start drivers load, using settings read from SYSTEM
        │
        ▼
4. The Session Manager (smss.exe) starts and the Configuration Manager
   loads the other machine hives: SOFTWARE, SAM, SECURITY, DEFAULT
        │
        ▼
5. Services start, and the sign-in screen appears
        │
        ▼
6. You sign in: your NTUSER.DAT is loaded and HKCU is linked to it
        │
        ▼
7. At sign-out: your hive is flushed to disk and unloaded

Memory view. Windows does not load the whole file as one big lump. It maps the hive in pieces (called views) as it needs them, and keeps the busy parts in memory. A small registry like yours (often tens or a few hundred megabytes in total across all hives) is easy for modern PCs to hold.

The SYSTEM copy problem. The boot loader reads SYSTEM before the Configuration Manager exists, so the loader contains its own small piece of code that can read the hive format. Later, the kernel re-reads it properly.

Windows tip: the "Last Known Good" idea. In older Windows versions you could press F8 at boot and pick Last Known Good Configuration, which used an older ControlSet. Modern Windows 10 and 11 no longer offers that menu in the same way; recovery now relies on Startup Repair, System Restore and the other tools in Section 10.

Summary