| Platform SDK: Registry |
A hive is a group of keys, subkeys, and values in the registry that has a set of supporting files containing backups of the data in the hive. The setup phase of the Windows NT/Windows 2000 boot process automatically retrieves data from these supporting files. You can also retrieve data manually using the Import Registry File menu item of the Registry Editor (Regedit.exe). When you shut down Windows NT or Windows 2000, the operating system automatically writes the hive data to the supporting files. You can also back up the hive data manually using the Export Registry File menu item of the Registry Editor.
The supporting files for all hives except HKEY_CURRENT_USER are in the Systemroot\System32\Config directory; the supporting files for HKEY_CURRENT_USER are in the Systemroot\Profiles\Username directory. The file name extensions of the files in these directories, and in some cases a lack of an extension, indicate the type of data they contain. The following table lists these extensions along with a description of the data in the file.
| File name extension | Description of the data |
|---|---|
| No extension | A complete copy of the hive data. |
| .alt | A backup copy of the critical HKEY_LOCAL_MACHINE\System hive. Only the System key has an .alt file. |
| .log | A transaction log of changes to the keys and value entries in the hive. |
| .sav | Copies of the hive files as they looked at the end of the text-mode stage in Setup.
Setup has two stages: text mode and graphics mode. The hive is copied to a .sav file after the text-mode stage of setup to protect it from errors that might occur if the graphics-mode stage of setup fails. If setup fails during the graphics-mode stage, only the graphics-mode stage is repeated when the computer is restarted; the .sav file is used to restore the hive data |
The following table lists the standard hives and their supporting files under Windows NT/Windows 2000.
| Registry hive | Supporting files |
|---|---|
| HKEY_LOCAL_MACHINE\SAM | Sam, Sam.log, Sam.sav |
| HKEY_LOCAL_MACHINE\Security | Security, Security.log, Security.sav |
| HKEY_LOCAL_MACHINE\Software | Software, Software.log, Software.sav |
| HKEY_LOCAL_MACHINE\System | System, System.alt, System.log, System.sav |
| HKEY_CURRENT_CONFIG | System, System.alt, System.log, System.sav |
| HKEY_CURRENT_USER | Ntuser.dat, Ntuser.dat.log |
| HKEY_USERS\.DEFAULT | Default, Default.log, Default.sav |
Hives are created for each user to store information on that user's usage of the system. Refer to User Profile Hives for more information.