Monday, December 31, 2018

The Classes branch is in another hive

HKEY_CURRENT_USER contains several subkeys, but not all of them are stored in same Registry hive file. As expected, most are from ntuser.dat in the root of the user profile, but the Classes subtree gets a hive to itself. It's stored in AppData\Local\Microsoft\Windows\UsrClass.dat. Interestingly, that file doesn't exist under the default user profile. It appears that the classes hive is initialized empty when profiles are created.

No comments:

Post a Comment