Registry

Registry files are stored in %SystemRoot%\System32\Config\:

• Sam – HKEY_LOCAL_MACHINE\SAM

• Security – HKEY_LOCAL_MACHINE\SECURITY

• Software – HKEY_LOCAL_MACHINE\SOFTWARE

• System – HKEY_LOCAL_MACHINE\SYSTEM

• Default – HKEY_USERS\.DEFAULT

• Userdiff – Not associated with a hive. Used only when upgrading operating systems.

The following file is stored in each user's profile folder:

• %UserProfile%\Ntuser.dat – HKEY_USERS\<User SID> (linked to by HKEY_CURRENT_USER)

For Windows 2000, Server 2003 and Windows XP, the following additional user-specific file is used for COM information:

• %UserProfile%\Local Settings\Application Data\Microsoft\Windows\Usrclass.dat (path is localized) – HKEY_USERS\<User SID>_Classes (HKEY_CURRENT_USER\Software\Classes)

For Windows Vista and later, the path was changed to:

• %UserProfile%\AppData\Local\Microsoft\Windows\Usrclass.dat (path is not localized) alias%LocalAppData%\Microsoft\Windows\Usrclass.dat – HKEY_USERS\<User SID>_Classes (HKEY_CURRENT_USER\Software\Classes)

Backup files can be found in

XP/2000 %Windir%\Repair\

Windows 7 %Windir%\System32\config\RegBack\

To access the restore points use psexec -s cmd

dir /a

References

http://en.wikipedia.org/wiki/Windows_Registry