Windows Registry
What Windows writes down about itself, and how to read it back.
The Windows Registry is the database Windows uses to store its settings. It holds how the machine starts, which programs are installed, who has signed in, which devices have been plugged in and much more. Windows reads and writes it all the time while it runs, so it fills up with a record of what happened on the machine. That record often outlasts the files or programs involved, which makes the Registry one of the first places an investigator looks.
The Registry is split into branches called hives, and each hive is a file on disk. The machine's own settings live in hives such as SYSTEM and SOFTWARE in C:\Windows\System32\config. Each user profile has its own hive, NTUSER.DAT, in that user's folder. A running machine shows these as the trees HKEY_LOCAL_MACHINE and HKEY_CURRENT_USER. Each setting sits at a path of keys and subkeys, like folders, and the values inside a key hold the data.
How to Use This Topic
Start with the explorer below. The buttons in its title bar pick a kind of question, such as Execution for whether a program ran or USB for what was plugged in. Pick one and the explorer lights up the keys that help. Open a key to see which tools can see it, with the query for each, and the values it holds decoded into plain English. Every value comes from ws-042, the fictional machine the wiki follows through one incident. Each key also has its own page with the full detail. It says what the key proves and what it cannot, how to read it, and the query in Defender XDR, Microsoft Sentinel, Velociraptor and Splunk. Pick a hive in the explorer to see what it holds and the way to collect its file.
Where to Start
New to the Registry? Read these keys first, in this order. Each one answers a different kind of question, and together they show how every key page works.
- UserAssist is the key the explorer opens on. Its page shows every part of a key page, from what the key proves to the query that finds it in each tool.
- Run and RunOnce Keys are where Windows starts a program each time a user signs in, so a hunt for anything that survives a restart often begins there.
- USBSTOR and USB Device Keys list the USB storage devices the machine has seen, with each serial number and when it was connected, which is where any question about a USB stick starts.
- ProfileList ties each account's security identifier (SID) to its profile folder, which usually carries the user name, and you need that to read the many keys that are filed by SID.
Machine Hives
- SYSTEM
- SOFTWARE
- SAM
- SECURITY
User Hives
- NTUSER
.DAT - Control Panel
- settings
.dat - Software
- Google
- Microsoft
- Office
- Office test
- OneDrive
- Terminal Server Client
- Windows
- CurrentVersion
- Applets
- CapabilityAccessManager
- Explorer
- ComDlg32
- FeatureUsageFeatureUsage (Taskbar Use)
- Map Network Drive MRU
- MountPoints2
- RecentDocs
- RunMRU
- StartupApproved
- TypedPaths
- User Shell FoldersStartup Folder Redirection
- UserAssist
- <GUID>
- CountUserAssist
- WordWheelQuery
- Windows NT
- Sysinternals
- UsrClass
.dat
Separate Hive
- Amcache
.hve
Machine Hives
User Hives
Separate Hive
UserAssist
Programs a user started from the desktop, Start menu or Explorer, with run counts.
Use it to show which programs a user started from the desktop or Explorer, how many times, and when they last did.
Can Your Tools See It?
Each tool is marked by how much of this key it can see. Pick one for its query and the log or table it reads.
Values
These are the values this key held on ws-042, the fictional machine the wiki follows. Pick a row to read what it tells you. UserAssist stores each name in ROT13, which swaps every letter for the one 13 places along the alphabet, so pzq.rkr is cmd.exe once decoded.
| Name | Type | Data |
|---|---|---|
REG_BINARY | 00 00 00 00 07 00 00 00 ... | |
REG_BINARY | 00 00 00 00 01 00 00 00 ... | |
REG_BINARY | 00 00 00 00 01 00 00 00 ... |
What It Tells You
alice opened cmd
Value: {1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\
alice opened cmd
.exe from the shell 7 times, last at 12 Oct 2026 09:41 UTC. UserAssist keeps no commands, so find what the prompt started in event 4688 in the Security log, if Audit Process Creation is on. {1NP14R77-02R7-4R5Q-O744-2RO1NR5198O7}\pzq .rkr REG_BINARY00 00 00 00 07 00 00 00 ...alice started psexec
.exe from her Downloads folder once, at 12 Oct 2026 09:58 UTC. PsExec runs commands on other machines, so find which hosts it reached. {374QR290-123S-4565-9164-39P4925R467O}\cfrkrp .rkr REG_BINARY00 00 00 00 01 00 00 00 ...alice started WinSCP from the USB stick that was drive E once, at 15 Oct 2026 16:47 UTC. A file transfer tool run from removable media is worth following, so work out what it sent and where.
R:\JvaFPC\ JvaFPC .rkr REG_BINARY00 00 00 00 01 00 00 00 ...
Sources
The definition of the Registry and the folder that holds its hive files come from this page. Each key's own page lists the sources for that key.