On disk, the Windows Registry isn’t simply one large file, but a set of discrete files called hives. Each hive contains a Registry tree, which has a key that serves as the root (i.e., starting point) of the tree. Subkeys and their values reside beneath the root.
Location of Windows Registry files
The Registry files are located in the following folder locations. The location of these registry hives are as follows:
HKEY_LOCAL_MACHINE\SYSTEM : \system32\config\systemHKEY_LOCAL_MACHINE\SAM : \system32\config\samHKEY_LOCAL_MACHINE\SECURITY : \system32\config\securityHKEY_LOCAL_MACHINE\SOFTWARE : \system32\config\softwareHKEY_USERS\UserProfile : \winnt\profiles\usernameHKEY_USERS.DEFAULT : \system32\config\default
The supporting files are as follows:
Some hives are volatile and don’t have associated files. The system creates and manages these hives entirely in memory; the hives are therefore temporary. The system creates volatile hives every time the system boots. Examples are:
HKEY_LOCAL_MACHINE\HARDWARE : Volatile hiveHKEY_LOCAL_MACHINE\SYSTEM\Clone : Volatile hive
These files are database files, and only RegEdit, Regedit32, and Kernel32 can read them. The primary tool in Windows 11/10/8/7 for working directly with the registry is Registry Editor. Read: Make Windows automatically backup Registry. To access it, simply type Regedit in Start Menu Search Bar and hit Enter.
If you need to read more on this, head over to TechNet. UPDATE: AccidentalADMIN has made a useful comment. He says: Every Windows has a Registry Key which lists every hive in the system. Run regedit to open the Registry Editor and navigate to the following key to get a complete list:
While on the topic of Registry, you might also want to see if some of these links interest you:
