Registry Hives Forensics Cheat Sheet

What it is

The Windows registry is not one file: it is a set of hives, each a binary file in regf format that Windows loads under a root key such as HKLM\SYSTEM or HKEY_USERS\<SID>. Collecting the hive files gives you the system configuration, installed software, services and drivers, local accounts, network history and, through each user's NTUSER.DAT and UsrClass.dat, a large share of the user-activity artifacts covered elsewhere on this site. This page covers the files themselves; individual keys have their own pages.

Location

Hive file	Path	Mounted as
`SYSTEM`	`C:\Windows\System32\config\SYSTEM`	`HKLM\SYSTEM` (services, USB, network interfaces, control sets)
`SOFTWARE`	`C:\Windows\System32\config\SOFTWARE`	`HKLM\SOFTWARE` (installed programs, Run keys, network profiles)
`SAM`	`C:\Windows\System32\config\SAM`	`HKLM\SAM` (local accounts, see SAM)
`SECURITY`	`C:\Windows\System32\config\SECURITY`	`HKLM\SECURITY` (audit policy, LSA secrets, cached domain logons)
`DEFAULT`	`C:\Windows\System32\config\DEFAULT`	`HKU\.DEFAULT` (profile used by the LocalSystem account)
`NTUSER.DAT`	Vista+: `C:\Users\<user>\NTUSER.DAT`; XP: `C:\Documents and Settings\<user>\NTUSER.DAT`	`HKU\<SID>` = `HKCU`
`UsrClass.dat`	Vista+: `C:\Users\<user>\AppData\Local\Microsoft\Windows\UsrClass.dat`	`HKU\<SID>_Classes` (ShellBags, file associations)
Service profiles	`C:\Windows\System32\config\systemprofile\`, `C:\Windows\ServiceProfiles\LocalService\` and `NetworkService\` (`NTUSER.DAT`)	Hives of the built-in service accounts
Other hives	`Amcache.hve`, `Syscache.hve`, `BCD` (`\Boot\BCD` or `\EFI\Microsoft\Boot\BCD`), `COMPONENTS`, `DRIVERS`, `ELAM`	Loaded on demand
Backups	`C:\Windows\System32\config\RegBack\`	See Retention

Every hive has transaction logs next to it: <hive>.LOG1 and <hive>.LOG2 (dual logging since Vista; new log format since Windows 8.1). HKLM\HARDWARE is built at boot and has no file. On a live system, HKLM\SYSTEM\CurrentControlSet\Control\hivelist maps loaded hives to their files.

What it proves

Configuration and state: computer name, time zone, installed software, services and drivers, network interfaces and profiles, USB devices, shares.
Persistence: Run keys, services, scheduled-task cache, IFEO and Winlogon entries, COM hijacks in UsrClass.dat.
Accounts: local users and groups from SAM, cached domain credentials and policy in SECURITY.
User activity: UserAssist, RecentDocs, ShellBags, MRU lists, typed paths, all tied to one account because they live in that user's hive.
Evidence of execution via ShimCache (SYSTEM), BAM (SYSTEM) and UserAssist (NTUSER).
A key's LastWrite time does not say which value changed, or why; many keys are rewritten by Windows itself.

Key fields

Structure	Field	Meaning
Base block (file header)	`regf` signature, primary and secondary sequence numbers	Equal numbers = clean hive; different = dirty, transaction logs must be replayed
Base block	Hive file name, last written timestamp	Internal name; the timestamp is no longer updated on Windows 8.1 and later
Key node	Name, LastWrite time, subkey and value lists, security	One per key
Value	Name, type (`REG_SZ`, `REG_BINARY`, `REG_DWORD`…), data	Values have no timestamp of their own
Cell	Size sign	Negative = allocated; positive = free cell that may still hold deleted keys or values

Because CurrentControlSet only exists on a live system, read HKLM\SYSTEM\Select\Current offline to know which ControlSet00x was active.

Timestamps

Timestamp	Set when	Format	Pitfalls
Key LastWrite	A value of the key or its list of subkeys changes	FILETIME, UTC	Only the key, not individual values; updates, maintenance and cleaners can bulk-rewrite keys
Timestamps inside value data	Defined by each artifact (UserAssist last run, BAM, ShimCache…)	FILETIME or other, usually UTC	Interpret per artifact; some are local time
Hive file times ($SI)	File written to disk	NTFS, UTC	With the Windows 8.1+ log format, changes can sit in `.LOG1`/`.LOG2` for up to an hour before reaching the hive file

Retention and clearing

Transaction logs and dirty hives: a hive copied from a running or crashed system is often dirty. Recent changes may exist only in .LOG1/.LOG2; always collect them and let the tool replay them.
RegBack: before Windows 10 1803, a scheduled task copied the system hives to config\RegBack, a handy older snapshot. Since 1803 the files are still there but 0 bytes, unless EnablePeriodicBackup (DWORD 1) is set under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Configuration Manager.
Deleted keys and values: deleting marks cells as free; their content survives until reused and can be recovered by Registry Explorer, yarp and similar tools. Transaction logs may also still hold older versions of pages.
Older copies: volume shadow copies, Windows.old after upgrades, and XP restore points (System Volume Information\_restore*\RP*\snapshot\_REGISTRY_*).
Cleaners (CCleaner-type tools) and attackers delete MRU keys or values; the parent key's LastWrite then marks the time of the cleanup.

Collection

KAPE target: RegistryHives (compound: RegistryHivesSystem, RegistryHivesUser, RegistryHivesMSIXApps), including .LOG* files and RegBack copies. RegistryHivesOther, Amcache, Syscache and BCD collect the remaining hives.
Velociraptor (Windows.Triage.Targets): RegistryHives, RegistryHivesSystem, RegistryHivesUser (same names; RegistryHivesOther also exists). Windows.Registry.NTUser.Upload uploads user hives via raw NTFS.
Built-in: loaded hives are locked. reg save exports a loaded key to a new file (admin rights needed); it does not copy the original file or its logs, so prefer a raw or shadow-copy based copy when possible:

reg save HKLM\SYSTEM E:\case\SYSTEM.hiv /y
reg save HKLM\SOFTWARE E:\case\SOFTWARE.hiv /y
esentutl.exe /y /vss C:\Windows\System32\config\SYSTEM /d E:\case\SYSTEM
reg query "HKLM\SYSTEM\CurrentControlSet\Control\hivelist"

Hives of users who are not logged on are not locked and can be copied directly.

Parsing tools

Registry Explorer (Eric Zimmerman): GUI with transaction-log replay, bookmarks for forensic keys and recovery of deleted keys and values.
RECmd (Eric Zimmerman): command-line batch processing, for example RECmd.exe -d E:\case\Registry --bn BatchExamples\DFIRBatch.reb --nl false --csv E:\out.
RegRipper (Harlan Carvey): plugin-based text reports, rip.exe -r SOFTWARE -f software.
yarp (Maxim Suhanov, open source): Python library and tools with log replay, deleted-data recovery and hive carving.
regipy (open source): Python library and CLI; regipy-process-transaction-logs rebuilds a dirty hive from its logs.
Velociraptor: raw_reg accessor and registry artifacts query hives on live endpoints; Plaso winreg parser adds keys to a super timeline.

Investigation tips

Always collect each hive with its .LOG1/.LOG2 files and check the dirty flag before trusting results; RegRipper does not replay transaction logs itself, so replay first (Registry Explorer, RECmd or regipy).
Map every NTUSER.DAT to its SID through HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList so activity is attributed to the right account.
Compare live hives with copies from shadow copies or RegBack to spot new services, Run keys or removed MRU entries.
Sort keys by LastWrite around the incident window: a cluster of writes in persistence locations is a fast lead, but confirm with value content.
Recover deleted keys: attackers often delete their Run value or service key after use, and the free cell can still hold it.
Do not forget UsrClass.dat: ShellBags and per-user COM hijacks live there, not in NTUSER.DAT.

Registry hives

Tools