Registry transaction logs (.LOG1/.LOG2)

Every registry hive file is accompanied by transaction logs that protect it against corruption. Windows writes changes to the log first, then to the primary hive file, so an interrupted write can be recovered. Windows XP used a single .LOG file; Windows Vista and later use two, .LOG1 and .LOG2, for example SYSTEM.LOG1 or NTUSER.DAT.LOG2.

Windows 8.1 and Windows Server 2012 R2 introduced a new log format and changed the write strategy. A change counts as flushed once it is safely in the log, and writing it into the primary file can be delayed, by up to about an hour according to the published format specification. As a result, a hive copied from disk can be dirty: recent keys and values exist only in the logs. A dirty hive is detected when the base block's checksum is wrong or its primary and secondary sequence numbers do not match.

For investigators this has two consequences:

• Always collect the .LOG1 and .LOG2 files together with each hive, including NTUSER.DAT and UsrClass.dat.
• Replay the logs before analysis. Tools such as Registry Explorer and RECmd can apply them to produce a clean hive.

Skipping this step can hide the most recent activity, such as a new persistence entry. See Registry hives for locations and collection.