Windows Registry

File Format
Name	Windows Registry
Ontology	Electronic File Formats System files Windows Registry
Extension(s)	.reg

The Windows Registry is used in various versions of Microsoft Windows to hold a number of configuration settings that affect how Windows and programs running under Windows run. The location and format differs by version of Windows.

Windows 3.11

The registry file is called REG.DAT and is in the %WINDIR% directory (the directory configured as the one holding system files).

Windows 9x, ME

The registry is stored as USER.DAT and SYSTEM.DAT in the %WINDIR% directory, and also CLASSES.DAT in Windows ME. There may also be separate USER.DAT files in user profile directories.

• Forensics Wiki: Windows 9x Registry File (CREG)

Windows NT and up

The registry is stored in binary files in %SystemRoot%\System32\Config\.

• Forensics Wiki: Windows NT Registry File (REGF)

.REG files

Registry entries can be exported in a text-based format as .REG files. In Windows 2000 and later, the file begins with "Windows Registry Editor Version 5.00", while earlier versions began with "REGEDIT4".

Links

• Forensics Wiki: Windows Registry
• Wikipedia: Windows Registry
• MSDN registry reference
• Yet Another Registry Utility (yaru)