Windows Me Annoyances

Behind the Scenes: Hives and DAT Files

HKEY_USERS and HKEY_LOCAL_MACHINE can be thought of as the only true root keys, because the Registry’s three other root keys are simply symbolic links, or “mirrors,” of different portions of the first two (see Section 3.1 earlier in this chapter). This means that only these two branches actually need to be stored.

Like its predecessors, Windows Me stores the HKEY_USERS and HKEY_LOCAL_MACHINE branches in two files, User.dat and System.dat, respectively. On a single-user system, both files are located in your Windows folder; on a multiple-user system, the User.dat file for each configured user is stored in that user’s personal folder. These files are all hidden, meaning that with Explorer’s default settings, you won’t be able to see or find them. To view hidden files, select Folder Options from Explorer’s View menu, choose the View tab, select the Show all files option, and click OK.

Not all Registry data is stored on your hard disk, however. Some keys are dynamic, in that they are held only in memory and are forgotten when you shut down. An example of a dynamic branch is HKEY_LOCAL_MACHINE\HARDWARE, which is built up each time Windows is started (an artifact of Plug and Play). Only static (non-dynamic) branches are stored on your hard disk.

Knowing which files comprise the Registry is important only for backup and emergency recovery procedures (see Section 3.3 later) and for troubleshooting (and so you don’t accidentally delete them). ...