Understanding the Registry Structure

This section describes the hierarchical organization of the registry and defines the overall structure of keys and value entries.

The primary building blocks for the registry are keys, values, and data. The database for the registry is organized into a hierarchical structure. It is first organized into keys, and each key contains one or more keys or one or more values.

Key 1
    Key 1        value
    Key 2        value
    Key 3
    Key 4        value

Key 2
Key 3

The Registry Editor displays the contents of the registry database in six root keys. The hierarchical structure that appears in Registry Editor is similar to how Windows Explorer displays hierarchical directory structures. Each of the root key names begins with "HKEY_" to indicate that the key is a unique identifier, called a handle.

The HKEYs contain one or more subkeys, and each of the subkeys may contain subkeys. Key and subkey names can contain visible characters, including spaces, underscores, letters, and symbols, but cannot contain backslashes (\). The keys are case-aware, but are not case-sensitive, meaning the keys will recognize upper and lower case, but not require them.

A key’s data is contained in the value. The data can be in the form of text, binary, or DWORD. Table 31.9 outlines the data types in the registry.

Table 31.9 Data types in the Windows 98 registry

Value	Description

Text	Variable length null-terminated set of characters
Binary	Variable length of hexadecimal digits
DWORD	Single 32-bit value that appears as an 8-digit hexadecimal number (DWORD stands for double word value)

The actual contents or location of a specific registry subkey may differ from what is described here, depending on the services and software installed. However, this description of the general organization will help you understand how to navigate the registry.

The Windows 98 registry structure represents database information specific to the computer and to individual users. The computer-specific information includes setting for hardware and software installed on the computer. The user-specific information includes settings in user profiles, such as desktop settings, preferences for certain software, and personal printer and network settings.

In Windows 98, data is written to the registry when a flush occurs—that is, after changed data has aged more than a few seconds, or when an application intentionally flushes the data to the hard disk.

Figure 31.2 shows the registry subtrees.

Figure 31.2 Windows 98 registry subtrees

The following briefly describes the registry root keys. Root keys are described in greater detail in "Working with the Registry Keys" later in this chapter.

HKEY_LOCAL_MACHINE

This key contains computer-specific information about the type of hardware installed and software settings. This information is used for all users who log on to this system. HKEY_LOCAL_MACHINE has several subkeys, described later in this chapter.

HKEY_CURRENT_CONFIG

This key handles Plug and Play and contains information about the current configuration of a multiple hardware configuration computer (for example, settings for a docking station). This key is a pointer to one of the configuration keys of HKEY_LOCAL_MACHINE\Config—the configuration key (000x for example, 0001) that contains information about the current configuration of hardware attached to the computer.

HKEY_DYN_DATA

Dynamic data (data stored in RAM on the system) is contained in this key. This information may change as devices are added to or removed from the computer. The information for each device includes the related hardware key and the device’s current status, including problems. The Device Manager uses this data to show the current hardware configuration, and this data is used to constantly update the System Monitor.

HKEY_CLASSES_ROOT

This key points to HKEY_LOCAL_MACHINE\ Software\Classes, which describes certain software settings. This key displays essential information about OLE and association mappings to support drag-and-drop operations, Windows 98 shortcuts (which are OLE links), and core aspects of the Windows 98 user interface.

HKEY_USERS

This key contains information about all the users who log on to the computer, including both generic and user-specific information. The generic settings are available to all users who log on to the computer. The information is made up of default settings for applications, desktop configurations, and so on. This key contains subkeys for each user that logs on to this computer.

HKEY_CURRENT_USER

This key points to a branch of HKEY_USERS for the user who is currently logged on.

Interpreting Value Entries in the Registry Keys

Registry Editor displays data in two panes. The value entries in the right pane are associated with the selected key in the left pane.

A value entry has three parts: the data type of the value (which appears as an icon), the name of the value, and the value itself. A value’s data cannot be larger than 16 KB. The limit to total registry size depends on available hard disk space and available memory.

Table 31.10 lists the data types currently used by the system.

Table 31.10 Current data types

Data type	Description

	Binary data. Most hardware component information is stored as binary data, and can be displayed in Registry Editor in binary or hexadecimal format. For example, Reboot Flag: 0x00000000.
	A sequence of characters representing human-readable text. For example, BitsPerPixel: "8".

Analyzing the Registry Files

The registry is logically one data store, but physically it consists of two different files to allow maximum flexibility for network configurations:

User-specific information is contained in User.dat. The information in this file is reflected in user profiles.
Hardware-specific and computer-specific settings are contained in System.dat. This information is reflected in hardware profiles and in the settings displayed in Device Manager.

By default, User.dat and System.dat are stored in the \Windows folder, but these two files can be located in physically different locations. For example, if user profiles are enabled, System.dat can be stored on the local hard disk and User.dat stored in each user’s logon directory (\Windows\Profiles\user_name) or on a server, allowing "roving" users to maintain the same desktop preferences wherever they log on to the network.

For information about how Windows 98 chooses between local and network versions of User.dat when loading a user profile, and how system policies can override settings in DAT files to enforce user-specific and computer-specific information, see Chapter 8, "System Policies."