Editing Windows Registry (section)

=== File locations ===
The registry is physically stored in several files, which are generally obfuscated from the user-mode APIs used to manipulate the data inside the registry. Depending upon the version of Windows, there will be different files and different locations for these files, but they are all on the local machine. The location for system registry files in Windows NT is <code>%SystemRoot%\System32\config\</code>; the user-specific HKEY_CURRENT_USER user registry hive is stored in <code>Ntuser.dat</code> inside the user profile. There is one of these per user; if a user has a [[roaming user profile|roaming profile]], then this file will be copied to and from a [[server (computing)|server]] at logout and login respectively. A second user-specific registry file named UsrClass.dat contains COM registry entries and does not roam by default.

==== Windows NT ====
Windows NT systems store the registry in a binary file format which can be exported, loaded and unloaded by the Registry Editor in these operating systems. The following system registry files are stored in <code>%SystemRoot%\System32\config\</code>:
* <code>Sam</code> – {{code|HKEY_LOCAL_MACHINE\SAM}}
* <code>Security</code> – {{code|HKEY_LOCAL_MACHINE\SECURITY}}
* <code>Software</code> – {{code|HKEY_LOCAL_MACHINE\SOFTWARE}}
* <code>System</code> – {{code|HKEY_LOCAL_MACHINE\SYSTEM}}
* <code>Default</code> – {{code|HKEY_USERS\.DEFAULT}}
* <code>Userdiff</code> – Not associated with a hive. Used only when upgrading operating systems.<ref>{{cite web | url = https://technet.microsoft.com/en-us/library/cc722562.aspx | title = Overview of the Windows NT Registry | access-date = 2011-12-02}}</ref>

The following file is stored in each user's profile folder:
* <code>%USERPROFILE%\Ntuser.dat</code> – <code>HKEY_USERS\<[[Security Identifier|User SID]]></code> (linked to by HKEY_CURRENT_USER)

For Windows 2000, Server 2003 and Windows XP, the following additional user-specific file is used for file associations and COM information:
* <code>%USERPROFILE%\Local Settings\Application Data\Microsoft\Windows\Usrclass.dat</code> (path is localized) – <code>HKEY_USERS\&lt;User SID&gt;_Classes</code> ({{code|HKEY_CURRENT_USER\Software\Classes}})
For Windows Vista and later, the path was changed to:
* <code>%USERPROFILE%\AppData\Local\Microsoft\Windows\Usrclass.dat</code> (path is not localized) alias <code>%LocalAppData%\Microsoft\Windows\Usrclass.dat</code> – HKEY_USERS\&lt;User SID&gt;_Classes ({{code|HKEY_CURRENT_USER\Software\Classes}})

Windows 2000 keeps an alternate copy of the registry hives (.ALT) and attempts to switch to it when corruption is detected.<ref>{{cite web | url = https://technet.microsoft.com/en-us/library/cc750583.aspx | title = Inside the Registry | access-date = 2007-12-28}}</ref> Windows XP and Windows Server 2003 do not maintain a <code>System.alt</code> hive because [[NTLDR]] on those versions of Windows can process the <code>System.log</code> file to bring up to date a System hive that has become inconsistent during a shutdown or crash. In addition, the <code>%SystemRoot%\Repair</code> folder contains a copy of the system's registry hives that were created after installation and the first successful startup of Windows.

Each registry data file has an associated file with a ".log" extension that acts as a [[transaction log]] that is used to ensure that any interrupted updates can be completed upon next startup.<ref name="Norris">{{cite web|archive-url=https://web.archive.org/web/20090529202753/http://amnesia.gtisc.gatech.edu/~moyix/suzibandit.ltd.uk/MSc/Registry%20Structure%20-%20Main%20V4.pdf|format=PDF|url=http://amnesia.gtisc.gatech.edu/~moyix/suzibandit.ltd.uk/MSc/|date=February 2009|title=The Internal Structure of the Windows Registry|publisher=Cranfield University|archive-date=29 May 2009|last=Norris|first=Peter|url-status=dead}}</ref>  Internally, Registry files are split into 4&nbsp;[[Kilobyte|kB]] "bins" that contain collections of "cells".<ref name="Norris" />

==== Windows 9x ====
The registry files are stored in the <code>%WINDIR%</code> directory under the names <code>USER.DAT</code> and <code>SYSTEM.DAT</code> with the addition of <code>CLASSES.DAT</code> in Windows ME. Also, each user profile (if profiles are enabled) has its own <code>USER.DAT</code> file which is located in the user's profile directory in <code>%WINDIR%\Profiles\&lt;Username&gt;\</code>.

==== Windows 3.11 ====
The only registry file is called <code>REG.DAT</code> and it is stored in the <code>%WINDIR%</code> directory.

==== Windows 10 Mobile ====
To access the registry files, the device needs to be set in a special mode using either:&nbsp;

* [https://www.wpinternals.net/ WpInternals] (Put the device into flash mode.)
* [https://www.microsoft.com/en-us/p/interop-tools-store/9nj3rs1t5n68 InterOp Tools] (Mount the MainOS Partition with MTP.)

If any of the above methods worked, the device's registry files can be found in the following location:
  {Phone}\EFIESP\Windows\System32\config