How NT Protects Its Hives

Windows NT has some built-in methods for protecting system hivefiles. First, in the NT system32config directory, several files have noextension (the hive files) and an equal number have the same prefix and a . logextension. Open a .log file with Notepad, and you see garbage. What is it?

This "garbage" is Windows NT's way of protecting itself fromfailed updates to hive files. When a hive file is being changed (for example,when you edit the Registry), the . log files ensure an unfinished writeoperation does not corrupt the hive. Such corruption can occur when the systemfails. Here's how the fault-tolerance process works:

If the system fails between steps 2 and 4, the information in the . log fileis sufficient to restore the hive file to its previous condition. Thus, the .log file isn't a complete backup­it's a recovery tool in case of accidents.

. log files aren't the only fault-tolerance measure NT provides. Thepreceding procedure applies to all hive files except for system, which isrequired to boot the computer. For system, NT uses a . log file and, each timethe system is booted, also backs up system to system.alt. You can't delete,move, or rename the system or system.alt files in system32config. If theoriginal system hive file is unavailable or doesn't work, NT can still boot thesystem. The .alt file becomes the system hive file, and a backup of it becomessystem.alt.

NT's automatic fault-tolerance features work well most of the time. Butwhen these protection measures can't help, (such as after reinstallation or whenyou make a change to the Registry that disables your system), you must rely onyour own hive backups to restore system information.