Windows Forensic Analysis DVD Toolkit, 2nd Edition

Inside the Registry

So, what is the Registry? If you remember back to DOS and early versions of Windows (3.1, 3.11, etc.), configuration information (drivers, settings) for the system was largely managed by several files—specifically, autoexec.bat, config.sys, win.ini (on Windows), and system.ini. Various settings within these files determined what programs were loaded and how the system looked and responded to user input.

Later versions of Windows replaced these files with the Registry, a central hierarchical database ( http://support.microsoft.com/kb/256986 ) that maintains configuration settings for applications, hardware devices, and users. This “database” (I'm using the term loosely) replaces the text-based configuration files used by the ...