Registry

Registry Window

Window Registry

Application Software Hardware

update Window features tools

Control panel

Window

Registry

Virus

DOS key Run command Registry

Files Virus

Registry Registry

setting Hardware users

database

(system setting) Device

Hardware Network

user Software

(Hierarchical Database System)

Registry Software setting Window Configuration setting User

profile Password Hashes account setting

Registry Microsoft window 32

bit version Hardware Information setting software user

screen saver wallpaper setting option database user

 Control panel setting system policies

software/applications

Registry reflected and stored

Registry O.S Appilication, Hardware, Software, Device

Driver Network Registry

Window Boot data

Registry Window Version Registry

Window 95/98 system.dat user.dat Binary

Window ME classic.dat Window NT/2000/XP

Hives Windows\system32\config Folder

Hives Registry

Registry Editor win.ini, system.ini,

boot.ini Notepad, Text Editor

setting Registry.exe setting edit

Registry %System Root%\System32\

Config Folder %System Root%\ System files

Folder NT/2000/XP

Window OS Registry Backup

(log) Backup %System Root%\Repair Folder

 Registry

Registry

Hard Disk directory structure window explorer

hierarchical database Registry hives Registry key

subkey values logical

Registry

hive hive key subkey

key value value data

Registry key root key

window xp window

HKEY_CLASSES_ROOT

HKEY_CURRENT_USER

HKEY_LOCAL_MACHINE

HKEY_USERS

HKEY_CURRENT_CONFIG XP

version HKEY_DYN_DATA

root key hive hive

key subkey key subkey Registry

value value data

 Registry Configuration File

Registry user

Window version

implement software install

user profile program

16-bit window program MS-DOS program

(Configuration data) .ini File text

File 32-bit window program

Configuration data Registry

Registry hardware configuration Plug and Play (PnP function) devices

config OS
hardware user

Desktop

shortcut menu properties

Network Remote Administrator

Registry logical physical Regedit

key value value data

logical physical Registry logical

physical

Window Registry contents

system.dat user.dat Binary

text editor .ini file text editor

edit read-only, hidden

properties system.dat

user.dat user

Registry editor Registry tool

Window Registry Registry editot

Registry Registry editor

key, values

Registry .reg (output)

Registry (input) .reg

batch file

Registry editor

Window tool user (manual)

 Window

Registry tools Norton Utilities Registry Mechanic tools

tools

Window Registry Hive

Hives HKEY_

HKEY KEY (handle to a key)

ROOT KEY

Level keys subkeys values values

data

key window explorer (deskstop) folder

folder values

(outline) (section) subkey

window explore folder folder subfolder

hierarchichal system ( child key (or ) child folder

parents keys parents folder

Branch Registry Branch sub

key Branch Registry Level

key key keys

sub key Outline

section

list

Value name Data Key Sub key

Value Value name Data

 Registry value name value

data

Registry root

key shortcut HKEY_CLASSES_ROOT:

HKCR HKCR Scrip

Program Path Path

Menu My computer\HKEY_CURRENT_CONFIG\

Display\Setting My computer HKEY_

CURRENT_CONFIG Display Settings value

 Program

Path HKCC\Display\Setting……

Root key (shortcut)

HKEY_CURRENT_ROOT HKCR

HKEY_CURRENT_USER HKCU

HKEY_CURRENT_MACHINE HKLM

HKEY_USERS HKU

HKEY_CURRENT_CONFIG HKCC

HKEY_DYN_DATA HKDD

HKEY_CLASSES_ROOT (HKCR) File name

Extension (.)

Window file

Filename extension files software program

.jpg file photo viewer program

.doc Word .txt Notepad .pmd pagemaker .pdf

Adobe acrobat setting mouse double-

click Context Menu User Interface shortcut

Object Link and Embedding (OLE)

HKEY_CURRENT _USER (HKCU) user

Software Hardware

user accounts

user accounts

accounts logon

user window setting desktop setting software

hardware setting user

user setting (effect )

profile setting user

HKEY_USER key data

user network

device

HKEY_LOCAL_MACHINE (HKLM) Operating System

Hardware

setting printer port storage

device Hardware install, unistall

software setting O.S

Devices Drivers (Security)

setting window service

User Login High level

key

HKEY_USER (HKU) System User

User customized setting

user security identifies (SID) user sub key

user [HKEY_CURRENT_USER (HKCU)]

[HKEY_USER_Default] data

user name setting

HKEY_CURRENT_CONFIG (HKCC)

hardware Setting HKEY_CURRENT _USER Log

on user

HKEY_LOCAL_MACHINE sub key Software system data

 Hardware setting

[HKEY_CURRENT_CONFIG] [HKEY_LOCAL_MACHINE \ config\ current]

setting [HKEY _CURRENT_

CONFIG] [HKEY_LOCAL_MACHINE_CONFIG_0001]

HKEY_DYN_DATA xp HKLM

version user PnP(plug and play)

system configuration RAM system device

added and removed boot system configuration

update

PnP complementary metal–oxide –semiconductor[CMOS]

power on

Registry hives (listed)

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\hivelist

standard hive .dat

.alt, .log .sav extension .alt

HKEY_LOCAL_MACHINE system line backup system key

.alt .log hive key entries

.sav hive (copier)

Registry line suppority files

HKEY_CURRENT_USER system, system. alt,system.log, syste .sav

HKEY_CURRENT_CONFIG nutser .dat, nttuser .dot .log
HKEY_LOCAL_MACHINE sam,sam .log,sectory.sw
HKEY_LOCAL_MACHINE/SECURITY Security,security .log, security .sav
HKEY_LOCAL_MACHINE/Software software, software .log, software,.sav
HKEY_LOCAL_MACHINE/System system,system.alt,system.log system.sav
HKEY_USER\DEFAULT Default, Default.log, Default.sav

file %system sort%\system32 \config folder userprofile username

%Userprofile%\Username folder

Registry Rum box regedit

Registry editor Dialog box box Area

key pane Area content pane key panes key

key content panes

selected hight light keys sub key value data

Data name Data type value data

String standard string

BINARY

DWORD

Multi string multiple string

Expendable date string

Resource list Full Resource Descriptor