HKEY_CURRENT_USER contains several subkeys, but not all of them are stored in same Registry hive file. As expected, most are from
ntuser.dat in the root of the user profile, but the
Classes subtree gets a hive to itself. It's stored in
AppData\Local\Microsoft\Windows\UsrClass.dat. Interestingly, that file doesn't exist under the default user profile. It appears that the classes hive is initialized empty when profiles are created.
No comments:
Post a Comment