Skip to content
WindowsForensics

Glossary

NTUSER.DAT

The per-user registry hive stored in each Windows profile and loaded as HKEY_CURRENT_USER, rich in user activity and persistence traces.

NTUSER.DAT is the main per-user registry hive. Each user profile has its own copy at the root of the profile folder, for example C:\Users\<username>\NTUSER.DAT (on Windows XP, under C:\Documents and Settings\<username>). When the user logs on, Windows loads it under HKEY_USERS\<SID> and exposes it as HKEY_CURRENT_USER.

Because it records a user's own settings and history, NTUSER.DAT is one of the most valuable sources for attributing activity to a specific account (identified by its SID). It holds, among others:

  • program launch traces such as UserAssist;
  • recently used files and commands, including RecentDocs, RunMRU, TypedPaths and the common dialog MRU lists;
  • per-user autostart entries in the Run keys;
  • application settings and recent file lists for many third-party programs.

The file is locked while the user is logged on, so it has to be collected from a forensic image, a Volume Shadow Copy or with raw-access tools rather than a simple copy. Collect the accompanying transaction logs (NTUSER.DAT.LOG1 and .LOG2) as well, since recent changes may exist only there. Remember that Explorer folder history (ShellBags) and some other shell data live in the second user hive, UsrClass.dat, which should always be collected alongside it.

Related artifacts