In order to locate your Windows Registry files you will need to know
which Windows platform you have. There are currently only two Windows
platforms that all versions of Windows are built on.
Windows XP, 2000, 2003, and NT 4.0 are all newer versions of the
Windows NT platform. They all use the NT Kernel32.dll, although the
Kernel32.dll has been updated / modified for each Windows operating
system.
Windows 95, 98, 98 SE, and ME use the Windows 95 Kernel32.dll and are
all part of the Windows 95 platform. Here again, the Kernel32.dll has
been updated / modified for each new operating system.
The Registry files cannot be read from a DOS prompt, the Recovery
Console, or even a text editor in Windows. These files are database
file, and only RegEdit, Regedit32 and the Kernel32 can read them.
Windows 95 platform
In Windows 95, 98, and 98 SE there are only two Registry files, the
location for both of the Windows Registry files is your Windows folder
(C:\Windows). The User.dat file for users not currently logged on are
in the Windows\Profile\<username> folder. Windows ME has three files,
also located in your Windows folder. They all have hidden attributes,
so in order to see them you will need to enable the Windows Explorer
to view the hidden files. The file names are System.dat and User.dat;
ME's third file is named Classes.dat.
The function of each file is different. System.dat stores all the
information about software, hardware, security, default Windows
settings, and how Windows will perform. User.dat stores all settings
that each user selects; these settings will override settings stored
in the System.dat file.
Classes.dat, used only on Windows ME, contains the CLSID Key
previously stored on the earlier versions of Windows in the System.dat
file. This new file was added in order to allow the Registry to be
greater than 11 megs. In Windows 98, Windows may report the inability
to load a Registry that is greater than 11 megs, in Windows 95 the
limit is 8 megs.
Each file has a backup made by Windows. Windows 95 creates a backup,
System.da0 (da zero) and User.da0, located in the Windows folder on
each reboot. Windows 98,98 SE, and ME creates a backup once a day of
the Registry files, using ScanregW.exe if you reboot every day.
Scanregw only backups on a reboot, unless you manually start Scanregw
and tell it to backup.
Scanregw backs up the Registry files to a cabinet file and stores them
in the Windows\Sysbckup folder. It will store up to 5 different
copies, RB000.cab to RB005.cab.
Windows also makes one backup copy of the Registry upon the
installation of Windows and stores it in the root (C:\). It does not
make a copy of the User.dat file. This copy of the Registry is named
System.1st and if you have Windows ME you will find Classes.1st there
also.
These Registry Files are loaded in RegEdit as Hives.
Windows NT platform
In Windows NT, XP, 2000, and 2003 there are several Registry files.
These files, with one exception, are named without a file extension
and are stored in the Windows\System32\Config folder. These files are
named Software, System, SAM, Security, Default, and UserDiff. There is
one more Registry file and it does have a file extension, NTuser.dat.
In Windows XP, 2000 and 2003, NTuser.dat is stored in the users folder
under the Documents and Settings folder. Each user has their own
NTuser.dat file. In Windows NT, the NTuser.dat file is stored in the
Config folder, not in the Documents and Settings folder.
The function of each file is different. Security stores information
about security. The SAM file stores information about the Security
Accounts Manager service. Neither of these two files, Security and
SAM, are viewable in RegEdit. System stores all the information about
hardware. Software stores information about your software and how
Windows will perform and stores the default Windows settings. The
Default file, stores all the default user settings, the NTuser.dat
file overrides the default user settings. The UserDiff file stores
information about the corresponding SubKeys in the HKEY_USERS Hive for
each registered user.
Each of these Registry files has its own backup which is made during
the Windows installation. They are located in the
Windows\System32\Config folder, and have a file extension name of sav.
These file are created at the end of the text base part of the Windows
installation, before the graphic part begins. Installing these sav
Registry files will reset Windows to the point of finishing the
Windows installation.
Windows XP also creates a current backup of the Registry each time
System Restore creates a restore point. These Registry files are
located in the System Restore Information folder on the same drive as
Windows is installed.
For security reasons, the Kernel32.dll protects these files from being
copied or altered without the use of the Kernel32.dll. You cannot
manually make backups, you cannot change some of the Keys'
information. You cannot read or view the Security or SAM Keys.
To make a backup of the Registry you will need to use either a third
party backup tool or Windows Backup. If you use the Windows Backup
tool you need to make a System State backup to backup the Registry. |
