Registry Hive
Definition
A binary file on disk that holds part of the Windows registry. The five logical roots map to physical hive files at C:\Windows\System32\config and in each user profile.
- Type
- Binary file on disk
- Logical roots
- Five, mapped to physical hive files
- System location
- C:\Windows\System32\config
- Per-user location
- Within each user profile
Common questions
Why do investigators image registry hive files separately rather than just browsing the live registry?+
A running system's registry can change during acquisition and the live view does not expose deleted or unallocated registry data, so examiners acquire the raw hive files and parse them offline with dedicated tools, which also recovers deleted keys and values still present in unallocated hive space.
Does every user profile have its own separate set of registry hives?+
Yes, alongside the system-wide hives in System32\config, each user profile carries its own hive, most importantly NTUSER.DAT, which records that user's individual settings, recently opened files, and application usage history, making per-user hives a key source of user-attributable evidence.
Related terms
- Amcache.hve
- A registry hive that records application install and execution metadata, including SHA-1 of executables, useful long after the original file is deleted.
- EVTX
- The XML-based binary event log format introduced in Windows Vista. Files live under C:\Windows\System32\winevt\Logs and are parsed with the Windows Event Viewer...
- KAPE
- Kroll Artifact Parser and Extractor: a triage framework that selectively collects forensic artefacts from a live or imaged system and parses them...
- Prefetch
- A Windows performance subsystem that records executable launches and the files they touch in the first 10 seconds of execution. The .pf...
- UserAssist
- A registry-tracked, ROT13-obfuscated record of GUI program launches per user, with run count and last-execution timestamp.