JSI Tip 0314 - Registry hives in the registry.
November 13, 1997
Permanent keys (those not created at boot) are identified in the hivelist subkey at:
HKEY_LOCAL_MACHINESystemCurrentControlSetControlhivelist
The one exceptions is HKEY_CURRENT_USER which is located at %SystemRoot%ProfilesUserName
The value entries identify the registry hives. All are type REG_SZ
Value Name | Default | D e s c r i p t i o n |
---|---|---|
REGISTRYMACHINEHARDWARE | None | The HKEY_LOCAL_MACHINEHardware key is recreated upon boot. |
REGISTRYMACHINESAM | DeviceHarddisk 0Partition1WINNTSystem32ConfigSAM | HKEY_LOCAL_MACHINESAM |
REGISTRYMACHINESECURITY | DeviceHarddisk 0Partition1WINNTSystem32ConfigSECURITY | HKEY_LOCAL_MACHINESecurity |
REGISTRYMACHINESOFTWARE | DeviceHarddisk 0Partition1WINNTSystem32ConfigSoftware | HKEY_LOCAL_MACHINESoftware |
REGISTRYMACHINESYSTEM | DeviceHarddisk 0Partition1WINNTSystem32ConfigSystem | HKEY_LOCAL_MACHINESystem |
REGISTRYUSER.DEFAULT | DeviceHarddisk 0Partition1WINNTSystem32ConfigDefault | HKEY_USERS.DEFAULT |
REGISTRYUSERSecurity ID (SID) | DeviceHarddisk 0Partition1WINNTProfilesUsernametuser.dat | The current user(s) profile.If services are running under user accounts,their entries are also located here. |
About the Author
You May Also Like