deardaniel/secdata-raw huggingface dataset:
Windows Registry Knowledge Base: Run and RunOnce

# Run and RunOnce

Run and RunOnce keys cause programs to run each time a user logs on. There are
system and per-user Run and RunOnce keys.

## Run and RunOnce keys

System Run and RunOnce keys:

```
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnceEx
```

Per-user Run and RunOnce keys:

```
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
```

Values:

Name | Data type | Description
--- | --- | ---
%NAME% | REG_SZ | Command to run or run once

### RunOnce\\Setup sub key

Contains first-boot activities after setup or when the Add/Remove Programs 
Wizard was used.

```
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\Setup
```

## RunServices and RunServicesOnce

Only on Windows 9x/Me.

Run in the background when the logon dialog box first appears, or at the boot 
process stage if there is no logon.

```
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce
```

Values:

Name | Data type | Description
--- | --- | ---
%NAME% | REG_SZ | Command to run or run once

## Notes

```
description-string=commandline
```

According to [Microsoft](https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys):

```
By default, the value of a RunOnce key is deleted before the command line is 
run. You can prefix a RunOnce value name with an exclamation point (!) to defer 
deletion of the value until after the command runs. Without the exclamation 
point prefix, if the RunOnce operation fails the associated program will not be 
asked to run the next time you start the computer.

By default, these keys are ignored when the computer is started in Safe Mode. 
The value name of RunOnce keys can be prefixed with an asterisk (*) to force 
the program to run even in Safe mode.
```

```
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows\Run
```

Installed "Programs and Features"

```
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer
```

## External Links

* [Run and RunOnce Registry Keys](https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys)
Windows Registry Knowledge Base: Mounted devices

# Mounted devices

The mounted devices settings are stored in the key:

```
HKEY_LOCAL_MACHINE\SYSTEM\MountedDevices
```

Note that the mounted devices settings are also referred to as
"Mount manager's persistent name database".

Seen on:

* Windows 2000
* Windows XP
* Windows 2003
* Windows Vista
* Windows 2008
* Windows 7
* Windows 8.0
* Windows 8.1
* Windows 10
* Windows 11

Values:

Name | Data type | Description
--- | --- | ---
%IDENTIFIER% | REG_BINARY | 

Where the following variants of %IDENTIFIER% can be used:

* "\DosDevices\C:" - drive letter that is assigned to the root of a file system
* "\DosDevices\F:\path\name" - drive letter that is assigned to a specific directory within a file system (has not been observed)
* "\??\Volume{01234567-89ab-cdef-0123-456789abcdef}" - unique volume identifier used within the Windows Kernel-Mode Object Manager
* "#{01234567-89ab-cdef-0123-456789abcdef}" - purpose current unknown

Where the value data consist of either:

* Device string value data
* GPT partition value data
* MBR partition value data

## Device string value data

The device string value data is variable of size and consists of:

Offset | Size | Value | Description
--- | --- | --- | ---
0 | ... | | UTF-16 little-endian encoded string, without an end-of-string character

For example:

```
\??\FDC#GENERIC_FLOPPY_DRIVE#6&12345678&0&0#{01234567-89ab-cdef-0123-456789abcdef}
\??\IDE#CdRomQEMU_QEMU_DVD-ROM_______________________1.6.____#5&12345678&0&0.1.0#{01234567-89ab-cdef-0123-456789abcdef}
\??\SCSI#CdRom&Ven_VBOX&Prod_CD-ROM#4&0123456&0&010000#{01234567-89ab-cdef-0123-456789abcdef}
_??_USBSTOR#Disk&Ven_Generic&Prod_Flash_Disk&Rev_8.07#01234567&0#{01234567-89ab-cdef-0123-456789abcdef}
```

## GPT partition value data

The GPT partition value data is 24 bytes of size and consists of:

Offset | Size | Value | Description
--- | --- | --- | ---
0 | 8 | "DMIO:ID:" | Signature, where DMIO is presumed to refer to Disk Manager I/O Driver
8 | 16 | | GUID Partition Table (GPT) partition identifier (little-endian GUID)

## MBR fixed-disk value data

The MBR partition value data is 12 bytes of size and consists of:

Offset | Size | Value | Description
--- | --- | --- | ---
0 | 4 | | Master Boot Record (MBR) Disk identity (signature) (also referred to as disk identifier)
4 | 8 | | Offset of the partition, in bytes, that contains the previously mounted file system

## Notes

The Windows `mountvol.exe` command-line tool can show information about mounted and unmounted
devices. Its PowerShell equivalant is `Get-Volume`.

Entries of volumes that are not presently mounted can be removed from the database with:

```
mountvol /r
```

## External Links

* [Supporting Mount Manager Requests in a Storage Class Driver](https://learn.microsoft.com/en-us/windows-hardware/drivers/storage/supporting-mount-manager-requests-in-a-storage-class-driver)
* [Windows Kernel-Mode Object Manager](https://learn.microsoft.com/en-us/windows-hardware/drivers/kernel/windows-kernel-mode-object-manager)
Windows Registry Knowledge Base: USB storage

# USB storage

The USBSTOR driver tracks various information about attached USB storage
devices in the key.

```
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USBSTOR
```

The USBSTOR key contains one or more device keys.

## Device key

The name of the device key is formatted as:

```
<Device Type>&Ven_<Vendor>&Prod_<Product>&Rev_<Revision Number>
```

Note that the number of values in the name is variable.

For example: `Disk&Ven_&Prod_&Rev_0.00` or `Disk&Ven_&Prod_`

The device key contains one or more device instance keys.

## Device instance key

The name of the device instance key is formatted as:

For example: `[PII_REDACTED]36a&0`

Sub keys:

Name | Description
--- | ---
Device Parameters |
LogConf |
Properties |

Values:

Name | Data type | Description
--- | --- | ---
Capabilities | REG_DWORD_LITTLE_ENDIAN |
Class | REG_SZ |
ClassGUID | REG_SZ |
CompatibleIDs | REG_MULTI_SZ |
ConfigFlags | REG_DWORD_LITTLE_ENDIAN |
ContainerID | REG_SZ |
DeviceDesc | REG_SZ |
Driver | REG_SZ |
FriendlyName | REG_SZ | Human readable description of the USB storage device
HardwareID | REG_MULTI_SZ |
Mfg | REG_SZ | Manufacturer information
Service | REG_SZ |

## Device Parameters key

Sub keys:

Name | Description
--- | ---
MediaChangeNotification |
Partmgr |

### Device Parameters\Partmgr key

Values:

Name | Data type | Description
--- | --- | ---
Attributes | REG_DWORD_LITTLE_ENDIAN |
DiskId | REG_SZ | Contains a GUID

## LogConf key

## Properties key

Sub keys:

Name | Description
--- | ---
%GUID% | Property set identifier

### Property set key (Properties\\%GUID%)

Sub keys:

Name | Description
--- | ---
%NUMERIC% | Property identifier

#### Property key (Properties\\%GUID%\\%NUMERIC%)

Sub keys:

Name | Description
--- | ---
%NUMERIC% |

#### Property value key (Properties\\%GUID%\\%NUMERIC%\\%NUMERIC%)

Values:

Name | Data type | Description
--- | --- | ---
Data | REG_BINARY | Value data
Type | REG_BINARY | Value type

Value type:

* 0x0007 value data contains a 32-bit little-endian integer
* 0x0010 value data contains a FILETIME
* 0x0012 value data contains an UTF-16 litte-endian encoded string

### Example

```
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\USBSTOR\Disk&Ven_HP&Prod_v100w&Rev_1024\AA951D[PII_REDACTED]&0\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\00000004\00000000

Property set: 540b947e-8b40-45bc-a8a2-6a0b894cbda2 (System.Devices)
Property identifier: 4 (PKEY_Device_BusReportedDeviceDesc)
Type: 0x00000012 (UTF-16 litte-endian encoded string)
Data: "HP v100w USB Device"
```

## External links

* [USB device registry entries](https://learn.microsoft.com/en-us/windows-hardware/drivers/usbcon/usb-device-specific-registry-settings)
* [Identifiers Generated by USBSTOR.SYS](https://learn.microsoft.com/en-us/windows-hardware/drivers/install/identifiers-generated-by-usbstor-sys)
* [DEVPKEY_Device_InstallDate](https://learn.microsoft.com/en-us/windows-hardware/drivers/install/devpkey-device-installdate)
* [DEVPKEY_Device_FirstInstallDate](https://learn.microsoft.com/en-us/windows-hardware/drivers/install/devpkey-device-firstinstalldate)
Windows Registry Knowledge Base: Language

# Language

The language settings are stored in the key:

```
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language
```

Values:

Name | Data type | Description
--- | --- | ---
`#` | REG_SZ | The name of the code page National Language Support file (.nls) <br/> Where # is a hexadecimal formatted LCID, e.g. 0409 <br/> Contains "l_intl.nls", which is a reference to "\Windows\System32\l_intl.nls"
Default | REG_SZ | The default system language, contains a hexadecimal formatted LCID
InstallLanguage | REG_SZ | contains a hexadecimal formatted LCID

## Language groups

```
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\Language Groups
```
Windows Registry Knowledge Base: Prefetch

# Prefetch

## Prefetch Parameters key

```
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters
```

Values:

Name | Data type | Description
--- | --- | ---
EnablePrefetcher | REG_DWORD |

### Enable Prefetcher value

Values:

Value | Description
--- | ---
0 | Disabled
1 | Application start prefetching enabled
2 | Boot prefetching enabled
3 | Application start and boot enabled

## External Links

* [Disabling Prefetch](https://learn.microsoft.com/en-us/previous-versions/windows/embedded/ms940847(v=winembedded.5))
* [Disable Prefetch (Standard 7 SP1)](https://learn.microsoft.com/en-us/previous-versions/windows/embedded/ff794503(v=winembedded.60))
Windows Registry Knowledge Base: Windows product information

# Windows product information

Windows product information can be found in the key:

```
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion
```

Values:

Name | Data type | Description
--- | --- | ---
BuildLab | REG_SZ |
CSDVersion | REG_SZ | Service pack
CurrentBuild | REG_SZ | Current build (obsolete) e.g. 1.511.1
CurrentBuildNumber | REG_SZ | Current build number e.g. 2600
CurrentType | REG_SZ |
CurrentVersion | REG_SZ | Current major and minor version e.g. 5.1
DigitalProductId | REG_BINARY |
InstallDate | REG_LONG |
LicenseInfo | REG_BINARY |
PathName | REG_SZ | Windows path name e.g. C:\Windows
ProductId | REG_SZ | Product identifier
ProductName | REG_SZ | Product name e.g Microsoft Windows XP
RegDone | |
RegisteredOrganization | REG_SZ | Registered organization
RegisteredOwner | REG_SZ | Registered owner
SoftwareType | REG_SZ | Software type e.g. SYSTEM
SourcePath | REG_SZ |
SubVersionNumber | |
SystemRoot | REG_SZ | The system root also the value of %SystemRoot%
Windows Registry Knowledge Base: Background activity moderator

# Background activity moderator (BAM)

The Background Activity Moderator (BAM) key seems to have been introduced in
Windows 10 after version 1709.

The BAM keys can be found in the following Registry paths:

```
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\UserSettings\
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\
```

Within the UserSettings key, there is a key for each user SID containing
a value for each tracked executable.

## Example Entry

Registry Key:

```
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\bam\State\UserSettings\S-1-5-21-32[PII_REDACTED][PII_REDACTED]27080-1000
```

Value Name:

```
\Device\HarddiskVolume1\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
```

Value Data:

```
00000000  15 3e ae 36 57 de d4 01 00 00 00 00 00 00 00 00  |.>®6WÞÔ.........|
00000010  00 00 00 00 02 00 00 00                          |........|
```

## Value Data Format

Offset | Size | Value | Description
--- | --- | --- | ---
0 | 8 | | Execution time <br> Contains a FILETIME
8 | 8 | | <mark style="background-color: yellow">**Unknown (empty values)**</mark>
16 | 4 | | Flag indicating whether the entry is a "Windows app"
20 | 4 | 0x02, 0x00, 0x00, 0x00 | <mark style="background-color: yellow">**Unknown (always 2)**</mark>
Windows Registry Knowledge Base: Session manager

# Session manager

The session manager settings are stored in the key:

```
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager
```

Values:

Name | Data type | Description
--- | --- | ---
BootExecute | REG_BINARY, REG_MULTI_SZ | Applications, services and commands executed during start-up.

## External links

* [MSDN: BootExecute](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc963230(v=technet.10))
Windows Registry Knowledge Base: Boot verification

# Boot Verification key

```
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BootVerification
```

The BootVerification key stores configuration for Bootvrfy.exe, a program
included in Windows Server 2003 that notifies the system that startup was
successful. Bootvrfy.exe can be run on a local or remote computer.

Known values of the BootVerification key:

Name | Data type | Description
--- | --- | ---
ErrorControl | REG_DWORD | Known value: 1
%SERVICE%\ImagePath | REG_EXPAND_SZ | Known value: "Bootvrfy.exe"
ObjectName | REG_SZ | Known value: "LocalSystem"
Start Entry | REG_DWORD | Known value: 3
Type Entry | REG_DWORD | Known value: 2

To run a custom startup verification program the standard startup verification
functions in Winlogon need to be disabled. This can be done by setting the
Winlogon ReportBootOk value to 0.

```
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
```

## Boot Verification Program key

```
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BootVerificationProgram
```

The BootVerificationProgram key stores configuration for a custom startup
verification program.

Known values of the BootVerificationProgram key:

Name | Data type | Description
--- | --- | ---
ImagePath | REG_SZ, REG_EXPAND_SZ | path of a custom startup verification program

According Windows server 2003 documentation Bootvrfy.exe and a custom startup
verification program cannot be used in parallel.

## External links

* [BootVerification](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc778559(v=ws.10))
* [BootVerificationProgram](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc782537(v=ws.10))
* [BootVerificationProgram\ImagePath](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc786702(v=ws.10))
* [ReportBootOk](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc739989(v=ws.10))
Windows Registry Knowledge Base: Certificates

# Certificates

```
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates
```

## External Links

* [Certificates Tools and Settings](https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2003/cc787544(v=ws.10))
Windows Registry Knowledge Base: Current control set

# Current control set

The Windows Registry contains the Current control set key:

```
HKEY_LOCAL_MACHINE\System\CurrentControlSet
```

## Current Control Set - Windows 9x/Me

In Windows 9x/Me the Current Control Set key is stored in the SYSTEM.DAT
Registry file.

## Current Control Set - Windows NT

On Windows NT the Current Control Set key is only present at run-time. The
contents of the key is stored in the SYSTEM Registry file and can be
determined by reading the Current value from the key:

```
<RootKey>\Select
```

The Current value contains number of the current control set. Normally 1 or 2 
but other values like 3 or 47 are known to be used. For example a value of 1
maps to the Control Set key:

```
<RootKey>\ControlSet001
```

Normally there are multiple Control Set keys the role each of the Control Set
keys can be different:

> ControlSet001 may be the last control set you booted with, while
> ControlSet002 could be what is known as the last known good control set, or
> the control set that last successfully booted Windows.

These roles are defined by the other values in the Select key:

Name | Data type | Description
--- | --- | ---
Current | REG_DWORD | Current Control Set
Default | REG_DWORD | Default Control Set
Failed | REG_DWORD | Control Set that failed to boot
LastKnownGood | REG_DWORD | Last known good Control Set

### Notes

* Determine if a value of 0 indicates not set
* Confirm if speculations that 9 is the largest value ControlSet00#
Windows Registry Knowledge Base: Volume shadow copies

# Volume shadow copies

## FilesNotToSnapshot key

```
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshot
```

Value| Data type| Description
--- | --- | ---
| %NAME% | REG_MULTI_SZ | Where %NAME% contains an array of strings that contain the path of files that are excluded from being added to a volume shadow snapshot. <br/> The files paths can contain the * wildcard.

## External Links

* [Excluding Files from Shadow Copies](https://learn.microsoft.com/en-us/windows/win32/vss/excluding-files-from-shadow-copies)
Windows Registry Knowledge Base: Shell folder identifiers

# Shell folder identifiers

Shell folder identifiers are class identifiers (CLSID) with ShellFolder sub
key of some [COM Class Identifier (CLSID) keys](https://winreg-kb.readthedocs.io/en/latest/sources/system-keys/COM-class-identifiers.html).

```
HKEY_CLASSES_ROOT\CLSID\{%GUID%}\ShellFolder
```

## Shell Folder class identifier (CLSID) sub key

Sub keys specific to shell folder identifiers:

Name | Description
--- | ---
shell |
shellex |
ShellFolder |

Values:

Name | Data type | Description
--- | --- | ---
(default) | |
InfoTip | |
LocalizedString | |
SortOrderIndex | |

### Shell Folder sub key

Values:

Name | Data type | Description
--- | --- | ---
Attributes | REG_DWORD |
CallForAttributes | |
HideOnDesktopPerUser | |

### Attributes values

Value | Identifier | Description
--- | --- | ---
0x00000010 | SFGAO_CANRENAME | The extension's root folder can be renamed by the user. The folder's shortcut menu will have a Rename item.
0x00000020 | SFGAO_CANDELETE | The extension's root folder can be deleted by the user. The folder's shortcut menu will have a Delete item.
0x00000040 | SFGAO_HASPROPSHEET | The extension's root folder has a Properties property sheet. The folder's shortcut menu will have a Properties item.
| |
0x20000000 | SFGAO_FOLDER | The extension's root folder contains one or more items.
0x80000000 | SFGAO_HASSUBFOLDER | The extension's root folder contains one or more subfolders. Windows Explorer will place a plus sign ( `+` ) next to the folder icon.

### LocalizedString value data

The LocalizedString value contains a localized version of the folder name, e.g.
on Windows XP the folder identifier key:

```
HKEY_CLASSES_ROOT\CLSID\{450d8fba-ad25-11d0-98a8-0800361b1103}
```

Has a LocalizedString value with the following data:

```
@%SystemRoot%\system32\SHELL32.dll,-9227
```

Which is the [MUI Form](https://winreg-kb.readthedocs.io/en/latest/sources/windows-registry/MUI-form.html)
for "My Documents".

## External Links

* [Implementing the Basic Folder Object Interfaces](https://learn.microsoft.com/en-us/previous-versions/windows/desktop/legacy/cc144093(v=vs.85))
* [libfwsi: Shell Folder identifiers](https://github.com/libyal/libfwsi/wiki/Shell-Folder-identifiers)
Windows Registry Knowledge Base: index

######################
Internet explorer keys
######################

.. toctree::
   :maxdepth: 1

   Browser helper objects <Browser-helper-objects>
   Policies <Policies>
   Typed URLs <Typed-URLs>
Windows Registry Knowledge Base: Types URLs

# Typed URLs

....
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs
....

Values:

Name | Data type | Description
--- | --- | ---
%ITEM% | REG_SZ | Where %ITEM% is a string in the form: "url[0-9]+"
Windows Registry Knowledge Base: Mount points

# Moint points

## MountPoints

```
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints
```

Seen on:

* Windows 2000

Sub keys:

Name | Description
--- | ---
%NAME% | Where %NAME% contains the name of the mount point (or drive mapping).

Where the following forms of %NAME% have been observed:

* Drive letter, for example "C"

### MountPoints name sub key

Sub keys:

Name | Description
--- | ---
`_Autorun` |
`_DIL` |
`_LabelFromReg` |

Values:

Name | Data type | Description
--- | --- | ---
`_UB` | REG_BINARY | 
BaseClass | REG_SZ | 
Version | REG_DWORD | 

## MountPoints2

```
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2
```

Seen on:

* Windows XP
* Windows 2003
* Windows Vista
* Windows 2008
* Windows 7
* Windows 8.0
* Windows 8.1
* Windows 10

Sub keys:

Name | Description
--- | ---
CPC | (Introduced in Windows Vista?)
CPC\LocalMOF | (Introduced in Windows 7?)
CPC\Volume | (Introduced in Windows Vista?)
%NAME% | Where %NAME% contains the name of the mount point (or drive mapping).

Where the following variants of %NAME% have been observed:

* Drive letter, for example "C"
* Volume identifier (GUID), for example "{01234567-89ab-cdef-0123-456789abcdef}"
* UNC path, for example "##1.2.3.4#username"

### MountPoints2 name sub key

Sub keys:

Name | Description
--- | ---
`_Autorun` |
`_Autorun\Action` |
`_Autorun\DefaultIcon` |
`_Autorun\DefaultLabel` |
Shell |
Shell\Autoplay |
Shell\Autoplay\DropTarget |
Shell\AutoRun |
Shell\AutoRun\Command |

Values:

Name | Data type | Description
--- | --- | ---
BaseClass | REG_SZ |
Windows Registry Knowledge Base: Delegate folders

# Delegate folders keys

Windows explorer uses delegate folders to provide alternative graphical
representations.

```
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\*\NameSpace\DelegateFolders\{%GUID%}
```

Values:

Name | Data type | Description
--- | --- | ---
(default) | REG_SZ | Name (or description) of the delegate folder.

## External links

* [DELEGATEITEMID structure (shobjidl_core.h)](https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/ns-shobjidl_core-delegateitemid)
Windows Registry Knowledge Base: Bit bucket

# Bit bucket

The Windows Explorer bit bucket key contains Recycler configuration
properties and information about the Recycler of connected volumes.

```
HKEY_CURRENT_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket
```

Seen on Windows 2000, XP and 2003.

Sub keys:

Name | Description
--- | ---
%NAME% | Where %NAME% contains a drive letter, for example "c"

Values:

Name | Data type | Description
--- | --- | ---
NoRecycleFiles | REG_DWORD | 
NukeOnDelete | REG_DWORD | 
Percent | REG_DWORD | 
UseGlobalSettings | REG_DWORD | 

## BitBucket\\%NAME% sub key

Values:

Name | Data type | Description
--- | --- | ---
IsUnicode | REG_DWORD | 
VolumeSerialNumber | REG_DWORD |
Windows Registry Knowledge Base: index

#####################
Windows explorer keys
#####################

.. toctree::
   :maxdepth: 1

   Bit bucket <Bit-bucket>
   Control panel item identifiers <Control-panel-item-identifiers>
   Delegate folders <Delegate-folders>
   Known folder identifiers <Known-folder-identifiers>
   Mount points <Mount-points>
   Most recently used (MRU) <Most-recently-used>
   Multilingual User Interface (MUI) cache <MUI-cache>
   Program cache <Program-cache>
   Shell folders <Shell-folders>
   Typed paths <Typed-paths>
   User assist <User-assist>