Windows Registry forensics: Windows registry file format specification

# Windows registry file format specification
-------

## Table of contents
  * [Types of files](#types-of-files)
    * [Examples of hives and supporting files](#examples-of-hives-and-supporting-files)
      * [Windows 8.1: System hive](#windows-81-system-hive)
      * [Windows 8.1: BCD hive](#windows-81-bcd-hive)
      * [Windows Vista: System hive](#windows-vista-system-hive)
      * [Windows Vista: SAM hive](#windows-vista-sam-hive)
      * [Windows XP: System hive](#windows-xp-system-hive)
  * [Transactional registry (TxR)](#transactional-registry-txr)
  * [Format of primary files](#format-of-primary-files)
    * [Base block](#base-block)
      * [Notes](#notes)
    * [Hive bin](#hive-bin)
      * [Notes](#notes-1)
    * [Cell](#cell)
      * [Index leaf](#index-leaf)
      * [Fast leaf](#fast-leaf)
      * [Hash leaf](#hash-leaf)
        * [Note](#note)
      * [Index root](#index-root)
        * [Notes](#notes-2)
      * [Key node](#key-node)
        * [Access bits](#access-bits)
        * [Class name](#class-name)
        * [WorkVar](#workvar)
        * [Flags](#flags)
        * [User flags](#user-flags)
        * [Virtualization control flags](#virtualization-control-flags)
        * [Debug](#debug)
        * [Layered keys](#layered-keys)
      * [Key values list](#key-values-list)
      * [Key value](#key-value)
        * [Data size](#data-size)
        * [Data types](#data-types)
        * [Flags](#flags-1)
      * [Key security](#key-security)
        * [Notes](#notes-3)
      * [Big data](#big-data)
        * [Data segment](#data-segment)
    * [Unallocated cell](#unallocated-cell)
    * [Summary](#summary)
  * [Format of transaction log files](#format-of-transaction-log-files)
    * [Old format](#old-format)
      * [Base block](#base-block-1)
        * [Notes](#notes-4)
      * [Dirty vector](#dirty-vector)
        * [Notes](#notes-5)
      * [Dirty pages](#dirty-pages)
        * [Notes](#notes-6)
    * [New format](#new-format)
      * [Base block](#base-block-2)
      * [Log entries](#log-entries)
        * [Notes](#notes-7)
  * [Dirty state of a hive](#dirty-state-of-a-hive)
  * [Multiple transaction log files](#multiple-transaction-log-files)
    * [Old format](#old-format-1)
    * [New format](#new-format-1)
  * [Flush strategies](#flush-strategies)
  * [Sector size and clustering factor](#sector-size-and-clustering-factor)
  * [Very old versions of Windows](#very-old-versions-of-windows)
  * [Additional sources of information](#additional-sources-of-information)

## Types of files
Stable registry hives consist of primary files, transaction log files, and backup copies of primary files. Primary files and their backup copies share the same format to hold actual data making up a Windows registry, transaction log files are used to perform fault-tolerant writes to primary files. Before writing modified (dirty) data to a primary file, a hive writer will store this data in a transaction log file. If an error (like a system crash) occurs when writing to a transaction log file, a primary file will remain consistent; if an error occurs when writing to a primary file, a transaction log file will contain enough data to recover a primary file and bring it back to the consistent state.

### Examples of hives and supporting files

#### Windows 8.1: System hive
* Primary file:
  * \Windows\System32\config\SYSTEM
* Transaction log files:
  * \Windows\System32\config\SYSTEM.LOG
  * \Windows\System32\config\SYSTEM.LOG1
  * \Windows\System32\config\SYSTEM.LOG2
* Backup copy of a primary file:
  * \Windows\System32\config\RegBack\SYSTEM

#### Windows 8.1: BCD hive
* Primary file:
  * \Boot\BCD
* Transaction log files:
  * \Boot\BCD.LOG
  * \Boot\BCD.LOG1
  * \Boot\BCD.LOG2

#### Windows Vista: System hive
* Primary file:
  * \Windows\System32\config\SYSTEM
* Transaction log files:
  * \Windows\System32\config\SYSTEM.LOG
  * \Windows\System32\config\SYSTEM.LOG1
  * \Windows\System32\config\SYSTEM.LOG2
* Backup copies of a primary file:
  * \Windows\System32\config\SYSTEM.SAV
  * \Windows\System32\config\RegBack\SYSTEM
  * \Windows\System32\config\RegBack\SYSTEM.OLD

#### Windows Vista: SAM hive
* Primary file:
  * \Windows\System32\config\SAM
* Transaction log files:
  * \Windows\System32\config\SAM.LOG
  * \Windows\System32\config\SAM.LOG1
  * \Windows\System32\config\SAM.LOG2
* Backup copies of a primary file:
  * \Windows\System32\config\RegBack\SAM
  * \Windows\System32\config\RegBack\SAM.OLD

#### Windows XP: System hive
* Primary file:
  * \WINDOWS\system32\config\system
* Transaction log file:
  * \WINDOWS\system32\config\system.LOG
* Backup copy of a primary file:
  * \WINDOWS\system32\config\system.sav

## Transactional registry (TxR)
Transactional registry, introduced in Windows Vista, is a feature that allows a program to accumulate multiple modifications of a registry hive within a transaction, which can be committed or rolled back as a single unit (like a database transaction). Such a transaction is written to storage files of the Common Log File System (CLFS).

Transactional registry and storage files of the CLFS are out of the scope of this document.

## Format of primary files
A primary file consists of a base block, also known as a file header, and hive bins data. Hive bins data consists of hive bins. Each hive bin includes a header and cells, cells are the actual storage of high-level registry entities (like keys, values, etc.). Primary files may contain a padding or remnant data of an arbitrary size after the end of the last hive bin.

![Primary file layout](https://raw.githubusercontent.com/msuhanov/regf/master/images/primary.png "Primary file layout")

### Base block
The base block is 4096 bytes in length, it contains the following structure in Windows XP (*hereinafter, all numbers and bit masks are in the little-endian form, all data units are bytes, unless otherwise mentioned*):

Offset|Length|Field|Value(s)|Description
---|---|---|---|---
0|4|Signature|regf|ASCII string
4|4|Primary sequence number| |This number is incremented by 1 in the beginning of a write operation on the primary file
8|4|Secondary sequence number| |This number is incremented by 1 at the end of a write operation on the primary file, a *primary sequence number* and a *secondary sequence number* should be equal after a successful write operation
12|8|Last written timestamp| |FILETIME (UTC)
20|4|Major version|1|Major version of a hive writer
24|4|Minor version|3, 4, 5, or 6|Minor version of a hive writer
28|4|File type|0|0 means *primary file*
32|4|File format|1|1 means *direct memory load*
36|4|Root cell offset| |Offset of a root cell in bytes, relative from the start of the hive bins data
40|4|Hive bins data size| |Size of the hive bins data in bytes
44|4|Clustering factor| |Logical sector size of the underlying disk in bytes divided by 512
48|64|File name| |UTF-16LE string (contains a partial file path to the primary file, or a file name of the primary file), used for debugging