Store App Hives (settings.dat and Helium)
Private hives each Store or MSIX app keeps in its package folder, outside NTUSER.DAT.
Use it to find settings that Store and packaged desktop apps keep outside NTUSER.DAT, some with a write time per value.
- NTUSER.DAT
- System Information
What It Is
Store apps and packaged desktop apps keep their own private hives in their package folder, outside NTUSER.DAT, so this is where their settings live. Those hives can name recent files, accounts or an app's last use. Some values carry their own write time, which ordinary registry values do not. The hives load only while the app runs, so most tools never see them. They live under each user's AppData\Local\Packages.
What It Proves
The app saved that setting for this user, which can name recent files, accounts or its last use. Values in settings.dat carry their own write time, which ordinary registry values do not.
What It Does Not Prove
Each app stores what it likes, so the contents vary by app and version. These hives load only while the app runs, so regedit and most hunting tools never see them.
Where It Lives
Store App Hives (settings.dat and Helium) lives in the NTUSER.DAT hive, and every user profile has its own copy, so what it shows belongs to one user. It has no path on a running machine, so collect the file and open it offline. The line under the path is where the hive file sits on disk.
settings.dat\C:\What It Looks Like
These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.
| Registry Value | What It Tells You |
|---|---|
| Notepad keeps a hive of its own for alice, last written 15 Oct 2026 16:47 UTC. Open it in Registry Explorer, because NTUSER |
| Notepad last saved a setting at 15 Oct 2026 16:47 UTC, so it was running then, during the USB session. Each value's last 8 bytes date that setting. |
| A packaged desktop app kept its HKCU writes in this User |
How to Read It
Find settings.dat in C:\Users\<user>\AppData\Local\Packages\<package>\Settings, while packaged desktop apps also keep User.dat and UserClasses.dat in a SystemAppData\Helium folder. Open each one as a hive in Registry Explorer, where settings.dat keeps its values under LocalState and RoamingState. Values in settings.dat use their own data types, and their last 8 bytes are a FILETIME in UTC of when the value was written.
- When Windows Writes It
- While the app runs, each time it saves a setting.
- Which Windows Versions
- Windows 8 to 11 keep them, with packaged desktop apps from Windows 10 1607.
- Tools That Parse It
- Registry Explorer, RECmd
Hunt It
These app hives are not loaded in the live Registry unless the app is running, so collect the files from AppData and parse them offline. What an app did is corroborated by its own logs and by EDR data.
Defender does not read per-app hives. Collect the Packages folders and open the hives offline.
Parse the Hive Instead
- Collect
C:\Users\ <user>\ NTUSER.DAT - Parse With
- Registry ExplorerRECmd
Confirm It With
One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Store App Hives (settings.dat and Helium) shows.
- BAMLists Store apps by package name, with when each last ran for this user.
- App Data Folders in AppData\Local\PackagesNot in the RegistryHolds the app's own files, which can confirm what its settings name.
Sources
The facts on this page come from these public pages, which say more on each point.