Section 1: Important Directories

The Big Picture: Windows Is Just Files

When you boot a PC, it can feel like "Windows" is one magic thing. It is not. Windows is a very large collection of files sitting in folders on your disk. Some are programs (.exe), some are shared code libraries (.dll, "Dynamic Link Library"), some are drivers (.sys), and some are data (settings, logs, fonts).

A directory is the technical word for a folder. Windows puts each kind of file in a certain place, the same way a house keeps cutlery in the kitchen and clothes in the bedroom. If you know the layout, you can tell at a glance what a file is for, and what is safe to touch.

Here is the top of a typical Windows drive. (Your C: drive is the system drive: the disk partition that holds Windows. You learned how partitions and file systems work in Chapter 19.)

C:\
├── Windows\                 the operating system itself
│   ├── System32\            64-bit system programs and DLLs (the heart)
│   │   ├── drivers\         device drivers (.sys files)
│   │   └── config\          the registry hive files
│   ├── SysWOW64\            32-bit system programs and DLLs
│   ├── WinSxS\              the component store (copies of system parts)
│   ├── Fonts\               installed fonts
│   ├── Boot\                boot-related support files
│   ├── Logs\ + Temp\        logs, and temporary files
│   └── Installer\           cached setup files for installed programs
├── Program Files\           64-bit apps you install
├── Program Files (x86)\     32-bit apps you install
├── ProgramData\             app data shared by all users (hidden)
├── Users\                   one folder per person
│   └── YourName\            your Desktop, Documents, AppData...
├── $Recycle.Bin\            deleted files waiting (hidden)
├── System Volume Information\  restore points (hidden, locked)
├── Recovery\                recovery tools data (hidden)
└── pagefile.sys, hiberfil.sys, swapfile.sys   (hidden system files)

Why many folders are hidden: Windows hides the most important folders so a beginner cannot damage the PC by accident. Later in this section you will learn how to make them visible just to look.

Golden rule for this whole chapter: Look, do not touch. Reading a system folder is safe. Deleting, renaming or moving things inside C:\Windows can stop Windows from starting.

1.1 C:\Windows (the OS root)

What it is: C:\Windows is the home of the operating system. It is also called the system root. Windows remembers this folder in a variable named %SystemRoot% (and %windir%). When a program says %SystemRoot%\System32, Windows turns that into the real path on your PC.

Why a variable? Most PCs use C:\Windows. But Windows can be installed on another drive letter or folder. A variable lets programs ask "where is Windows?" instead of guessing.

What lives directly inside it:

Windows tip: Open File Explorer and go to C:\Windows. You may see a yellow notice: "These files are hidden" or "you need permission". That is Windows protecting itself.

1.2 System32 (64-bit system binaries)

What it is: C:\Windows\System32 is the most important folder on the computer. It holds thousands of the core programs (.exe), shared libraries (.dll) and tools that Windows and your apps need. Programs like cmd.exe, notepad.exe, taskmgr.exe and ntoskrnl.exe (the kernel, Section 2) live here.

The confusing name. On a modern 64-bit Windows PC, System32 holds 64-bit files. The "32" does not mean 32-bit. It is a historical name from the 32-bit Windows days (Windows NT, 1990s). When 64-bit Windows came along, thousands of programs had the path System32 written inside them. Changing the name would have broken all of them. So Microsoft kept the name for compatibility and put the 32-bit files somewhere else (see 1.3). Yes, it is confusing on purpose, to keep old software running.

Important sub-folders:

How big is it? It usually holds several thousand files. You do not need to learn them all. Learn the handful in Section 2.

1.3 SysWOW64 (32-bit compatibility binaries)

What it is: C:\Windows\SysWOW64 holds the 32-bit versions of the system programs and DLLs on a 64-bit Windows PC.

Why it exists: Millions of old programs were written as 32-bit software. A 32-bit program cannot load 64-bit DLLs (the two do not mix inside one program). So Windows keeps a full set of 32-bit DLLs for them.

What WOW64 means: WOW64 stands for "Windows 32-bit On Windows 64-bit". It is a small layer inside Windows that lets 32-bit programs run on a 64-bit system. It also redirects the folder name: when a 32-bit program asks for C:\Windows\System32, WOW64 quietly gives it C:\Windows\SysWOW64 instead. The program thinks it is using System32, and gets the right 32-bit files.

64-bit program                        32-bit program
asks for System32\kernel32.dll        asks for System32\kernel32.dll
        │                                     │
        ▼                                     ▼ (WOW64 redirects)
C:\Windows\System32\kernel32.dll      C:\Windows\SysWOW64\kernel32.dll
   (64-bit file)                         (32-bit file)

Remember it as: the names are the wrong way round, on purpose, for old programs.

1.4 WinSxS (Side-by-Side component store)

What it is: C:\Windows\WinSxS is the component store. "SxS" means "side-by-side". It keeps several versions of system pieces next to each other, so Windows can update, repair or roll back components safely.

An analogy: Imagine a warehouse of spare parts. The files you actually use in System32 are often hard links to files stored here. A hard link is a second name for the very same data on disk, so the file is stored only once even if two paths point to it.

Why it matters:

• Windows Update puts new versions of components here. If an update fails, Windows can go back to the old version.
• Repair tools (such as DISM and sfc, Section 3) take good copies from here.
• Optional features (for example, "Windows Subsystem" features you turn on in Windows Features) are stored here too.

Why it looks huge. File Explorer often reports WinSxS as many gigabytes, but part of that is the same file counted twice (because of hard links). The real extra disk space used is usually less than it appears.

Can I delete it? No. Do not delete files in WinSxS by hand. Doing so can break Windows Update, repairs and even boot. If you need space, use the supported tool, which cleans up old, superseded versions safely:

DISM /Online /Cleanup-Image /AnalyzeComponentStore     (just reports; run as admin)
DISM /Online /Cleanup-Image /StartComponentCleanup     (cleans safely; changes things)

In this chapter's lab you will only run the read-only Analyze/Check commands. Windows also runs a scheduled cleanup task on its own.

1.5 Program Files (64-bit apps)

What it is: C:\Program Files is the default place for 64-bit programs you install, such as a browser or an editor. Each app usually gets its own sub-folder holding its .exe, DLLs and resources.

Why it is protected: A normal user is not allowed to write here without administrator approval. That is why installers show the "Do you want to allow this app to make changes?" prompt (UAC, User Account Control). The protection stops harmful programs run by a normal user from replacing trusted programs.

Built-in ones: Some Microsoft apps live here too, such as Windows Defender and Common Files (a folder for code shared by several programs).

1.6 Program Files (x86) (32-bit apps)

What it is: C:\Program Files (x86) is the folder for 32-bit programs on a 64-bit PC. The "x86" is the old name of the 32-bit Intel instruction set (from chips like the 8086, 80386 and so on). This folder exists only on 64-bit Windows.

Why two folders? So that the 32-bit and 64-bit versions of the same program do not overwrite each other. An installer chooses the right one. Like System32 and SysWOW64, WOW64 steers 32-bit programs to the 32-bit folder when they ask for "Program Files".

On a 32-bit copy of Windows there is only one Program Files. Almost all Windows 10 and 11 PCs today are 64-bit.

1.7 ProgramData (shared app data, all users)

What it is: C:\ProgramData holds data that apps share between all users of the PC: settings, license files, caches, databases. It is hidden by default.

Compare with the other places:

Windows tip: The folder is the modern replacement for the old Documents and Settings\All Users\Application Data. Windows keeps a link with the old name for old programs. Also, %ProgramData% is the variable that points to this folder.

1.8 Users (per-user profiles)

What it is: C:\Users holds one folder per person who uses the PC. Each folder is a user profile: everything that belongs to that person.

What is inside C:\Users\YourName:

Other folders in C:\Users:

• Public — a folder anyone on the PC can use to share files.
• Default — a template profile. When a new user signs in for the first time, Windows copies this to make their profile. (It is hidden.)
• All Users — a link that points to C:\ProgramData (for old programs).

Why this matters: Your files and settings live apart from Windows. That is why you can reinstall Windows and still keep your documents, if you save them or choose "keep my files".

1.9 AppData (Roaming, Local, LocalLow)

What it is: C:\Users\YourName\AppData is a hidden folder in which programs keep your settings, caches and saved state. It has three sub-folders:

Everyday example: Your browser's saved cache sits in AppData\Local, which is why clearing it frees space. A text editor's preferences may sit in AppData\Roaming.

Useful shortcut: Press Win + R, type %AppData% and press Enter. That opens the Roaming folder. Type %LocalAppData% to open Local.

Safe habit: Do not delete things in AppData unless you know the app. Deleting the right folder can reset an app (sometimes a good fix), but deleting the wrong one can lose settings or data.

1.10 Temp directories

What it is: A temp (temporary) directory is a scratch folder where programs drop files they need only for a short time: unpacked installers, partly-downloaded files, working copies.

Where they are:

Why they grow: Programs are supposed to clean up after themselves, but many do not. So temp folders slowly fill with leftovers.

Is it safe to clear? Generally the content is safe to remove, because files still in use are locked and Windows will refuse to delete them. But the safest way is the built-in tool (Disk Cleanup or Storage settings), not hand-deleting. In this chapter's lab you only look.

1.11 System Volume Information (restore points, shadow copies)

What it is: C:\System Volume Information is a hidden, locked folder on each drive. Windows uses it for features that keep old versions of your system:

• System Restore points — snapshots that let you roll Windows back (Section 3).
• Shadow copies (VSS, Volume Shadow Copy Service) — frozen "point-in-time views" of a drive, used by backup tools and the "Previous Versions" feature.
• Other volume bookkeeping, such as tracking data for the file system.

Why can't I open it? Only the SYSTEM account (Windows itself) has access. Even an administrator gets "Access denied" unless they change the permissions. This is on purpose: these files are the safety net, and tampering would break restore.

Where do I see how much space it uses? In System Properties → System Protection → Configure, you can see the disk space used and set a limit. You do not need to open the folder.

1.12 $Recycle.Bin

What it is: C:\$Recycle.Bin is the hidden folder behind the Recycle Bin icon on your desktop. When you delete a file normally, Windows does not erase it: it moves it here, so you can restore it.

How it works:

• Each user gets a sub-folder named by their security ID (SID), a long code like S-1-5-21-…, so users do not see each other's deleted files.
• Inside, a deleted file is stored under a new name beginning with $R (the data), with a matching $I file (a small note recording the original path and time).
• Every drive has its own $Recycle.Bin.

When is it really gone? When you empty the Recycle Bin, or press Shift + Delete, the file's space is marked free (the data may still be recoverable until overwritten; see the earlier chapters on how deleted files work).

1.13 Other Folders Worth Knowing

Besides the twelve above, a few more show up often:

1.14 Hidden System Files in the Root of C:

Some files in the root of C:\ are big and hidden. File Explorer hides them under Hide protected operating system files.

Why they are big: pagefile.sys and hiberfil.sys can be several gigabytes, often related to your RAM size. Windows manages them. You can change their size in settings, but never delete them by hand: Windows holds them open and wants them there.

1.15 The EFI System Partition (a hidden drive that holds the boot files)

What it is: On a modern UEFI PC (Chapter 6 covers booting), the files that start Windows are not in C:\Windows. They are on a small separate partition called the EFI System Partition (ESP). It is formatted as FAT32 (a simple file system the firmware can read) and is usually around 100 to 500 MB.

Important files inside it:

EFI System Partition (not given a drive letter)
└── EFI\
    └── Microsoft\
        └── Boot\
            ├── bootmgfw.efi     the Windows Boot Manager (UEFI program)
            └── BCD              Boot Configuration Data (the boot menu list)

What BCD is: The Boot Configuration Data is a small database (stored like a registry file) that lists which operating systems to boot and with what options. It replaced the old boot.ini file.

Windows tip: The ESP is hidden from File Explorer. You can see it in Disk Management as "EFI System Partition". On older BIOS/MBR PCs, the boot files (bootmgr and a Boot\BCD folder) lived on a small System Reserved partition or on C: itself.

1.16 How to See Hidden Folders (View Only)

In File Explorer:

1. Open File Explorer, then View → Show → Hidden items (Windows 11), or the View tab → Hidden items (Windows 10). This reveals ProgramData, AppData and similar.
2. To see the most protected ones (pagefile.sys, System Volume Information) go to View → Options → View tab and untick Hide protected operating system files (Recommended). Windows gives a warning. After looking, turn it back on.

In Command Prompt or PowerShell (read-only commands):

dir /a C:\                     (shows hidden and system items in the root)
dir /a:h C:\                   (shows hidden items only)

Get-ChildItem C:\ -Force       # -Force includes hidden and system items
Get-Item C:\Windows\System32   # info about one item

dir /a and Get-ChildItem -Force do not change anything. They just list.

Summary