Registry Structure: Hives, Keys, and Values

The Registry is organized in a hierarchical, tree-like structure, conceptually similar to folders and files in the file system.

• Hives: These are the top-level containers, analogous to the root directories of the Registry. Each hive represents a major section of configuration data. The main hives are:

  • HKEY_LOCAL_MACHINE (HKLM): Stores system-wide settings related to hardware, operating system configuration, and installed software that applies to all users. These settings are physically stored in several files (without extensions) located in the C:\Windows\System32\config directory, such as SAM, SECURITY, SOFTWARE, and SYSTEM.

  • HKEY_CURRENT_USER (HKCU): Contains settings specific to the currently logged-in user. This includes user preferences, application settings for that user, desktop configuration, environment variables, etc. This hive is physically stored in the user's profile directory, typically at C:\Users\{username}\NTUSER.DAT.

  • HKEY_USERS (HKU): Contains the HKEY_CURRENT_USER hive for the currently logged-on user, as well as hives for other user profiles loaded on the system (including default and system profiles identified by their SIDs).

  • HKEY_CLASSES_ROOT (HKCR): Primarily deals with file associations, COM object registrations, and UI-related information. It's largely a merged view derived from specific keys within HKLM\Software\Classes and HKCU\Software\Classes.

  • HKEY_CURRENT_CONFIG (HKCC): Holds information about the hardware profile currently being used by the system, generally derived from keys within HKLM.

• Keys / Subkeys: Within each hive, information is organized into Keys and Subkeys. These function like folders and subfolders, providing a logical structure for related settings. For example, HKCU\Software\Microsoft\Windows contains numerous subkeys related to the Windows settings for the current user.

• Values: These are the actual data entries stored within keys. Each value consists of three parts:

  1. Name: An identifier for the specific setting (e.g., EnablePrefetcher). A key can have a "(Default)" value which may or may not contain data.

  2. Data Type: Defines the format of the data being stored (see below).

  3. Data: The actual configuration setting or information itself (e.g., 3, C:\Program Files\MyApp, 0x00000001).