Windows Registry Hive
| Format | Windows Registry Hive |
|---|---|
| Short name | Registry Hive |
| Category | database |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
Windows hierarchical configuration database stored as binary hive files. Key forensic hives: SYSTEM (C:\Windows\System32\config\SYSTEM) — boot config, services, USB device history (USBSTOR), network interfaces, ShimCache, timezone; SOFTWARE — installed programs, Windows version, run keys, scheduled tasks; SAM — local account metadata, login counts, last login timestamps; NTUSER.DAT (%USERPROFILE%) — UserAssist (GUI execution with run counts and timestamps, ROT-13 encoded), RecentDocs MRU, TypedPaths, ShellBags, OpenSaveMRU, persistence run keys; UsrClass.dat — ShellBags for non-desktop folders, MUICache; Amcache.hve (C:\Windows\AppCompat\Programs\) — SHA-1 hashes and timestamps of programs present or executed on the system (an entry alone does not prove execution — corroborate with other artifacts). Each key has a LastWriteTime (Windows FILETIME: 100-nanosecond intervals since 1601-01-01 UTC). Transaction logs (.LOG1/.LOG2) contain uncommitted changes not yet written to the primary hive — must be merged for complete analysis. Deleted keys may survive in hive slack space.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 72 65 67 66 | regf | Registry hive signature ('regf') |
Known extensions
.dat, .hve, .log1, .log2
References
- Windows Registry hive format specification (Maxim Suhanov) https://github.com/msuhanov/regf/blob/master/Windows%20registry%20file%20format%20specification.md
- Investigating Windows Registry (ElcomSoft, Oleg Afonin, 2026) https://blog.elcomsoft.com/2026/02/investigating-windows-registry/
- AmCache Analysis (ANSSI, Blanche Lagny, 2019) https://www.ssi.gouv.fr/publication/amcache-analysis/
- Windows Registry (ForensicsWiki) https://forensics.wiki/windows_registry/
- Registry Explorer and RECmd (Eric Zimmerman tools) https://ericzimmerman.github.io/#!index.md
Cite this entry
Crush Format Reference, “Windows Registry Hive”. https://kalink0.github.io/crush-forensics/formats/registry-hive/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction