Open DAT File

Windows Registry Structure

Windows registry is structured into multiple hives. Registry hive is a logical set of keys, subkeys and values. Each registry hive has a primary file with hive data, .log file with transaction log which stores every transaction executed on this hive and .sav file which stores a backup of the last good state of the hive. System hive also has .alt file which stores a backup copy of HKEY_LOCAL_MACHINE\System, a critical part of a registry.

Below are hives used by Windows:

• HKEY_CURRENT_CONFIG stored in System, System.alt, System.log, System.sav files
• HKEY_CURRENT_USER stored in Ntuser.dat, Ntuser.dat.log files
• HKEY_LOCAL_MACHINE\SAM stored in Sam, Sam.log, Sam.sav files
• HKEY_LOCAL_MACHINE\Security stored in Security, Security.log, Security.sav files
• HKEY_LOCAL_MACHINE\Software stored in Software, Software.log, Software.sav files
• HKEY_LOCAL_MACHINE\System stored in System, System.alt, System.log, System.sav files
• HKEY_USERS\.DEFAULT stored in Default, Default.log, Default.sav files

Registry files could be of two formats: standard and latest. Standard file format is used for compatibility with Windows 2000, because that is the only format which Windows 2000 can process. Standard format is also supported by later versions of Windows for backward compatibility. The following hives use standard format: HKEY_CURRENT_USER, HKEY_LOCAL_MACHINE\SAM, HKEY_LOCAL_MACHINE\Security, and HKEY_USERS\.DEFAULT.

Registry files are located in %SystemRoot%\System32\Config directory. Files in this directory are updated every time new application is installed or uninstalled, user log ins or log outs and in many other cases. Also, it is important to know that these files do not completely represent Windows registry. Certain parts of Windows registry are formed in memory when operating system is loading.

If you need to look at the specific parts of the Windows registry you can use regedit.exe tool which can navigate registry keys and subkeys in an easy to use User Interface. Alternatively you can use reg.exe tool to query or export parts of the registry.