Glossary
Registry Hive
An on-disk file that backs part of the Windows Registry, such as `SYSTEM`, `SOFTWARE`, or `NTUSER.DAT`.
A registry hive is a single file on disk that stores one branch of the Windows Registry. Although the Registry appears to the user as one unified tree, it is physically split across several hives that are loaded and mapped into memory at boot or logon.
The system-wide hives — SYSTEM, SOFTWARE, SAM, and SECURITY — live in C:\Windows\System32\config. Per-user settings are kept in NTUSER.DAT and UsrClass.dat inside each user's profile. Every hive is accompanied by transaction logs (the .LOG, .LOG1, and .LOG2 files) that record pending changes so the hive can be recovered after a crash.
For investigators, hives are rich evidence: they record installed software, user activity, autostart entries, attached devices, and configuration. Tools parse the raw hive files offline, and the transaction logs can reveal changes not yet written into the main hive.
Related artifacts
- Amcache.hveAmcache.hve cheat sheet: file and program inventory keys, SHA-1 hashes, PE metadata, timestamps and why an entry alone does not prove execution.
- Bluetooth paired devicesBluetooth devices cheat sheet: BTHPORT paired device keys, MAC addresses and names, LastSeen/LastConnected times, BTHENUM, event logs and fsquirt transfers.
- DPAPI and Credential ManagerDPAPI and Credential Manager cheat sheet: master keys, Windows Vault, what secrets they hold, offline decryption requirements and credential-theft traces.
- IFEO and Winlogon persistenceIFEO and Winlogon cheat sheet: Debugger hijacks, GlobalFlag and SilentProcessExit, sticky keys backdoors, Userinit/Shell, Notify and AppInit_DLLs.
- Installed Programs (Uninstall Keys, MSI, AppX)Installed programs cheat sheet: Uninstall keys, MsiInstaller events 1033/11707, cached MSIs, AppX packages, winget logs and Amcache to date software installs.
- Registry hivesRegistry hives cheat sheet: SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT, UsrClass.dat, transaction logs, RegBack, LastWrite times and collection.
- SAM hive and user accountsSAM hive cheat sheet: local accounts, RIDs, last logon and password change times, logon counts, group membership, ProfileList, and account-related event IDs.
- Syscache.hveSyscache.hve cheat sheet: the Windows 7 / Server 2008 R2 hive in System Volume Information that links MFT file IDs to SHA-1 hashes, and its limits.