What is the difference between a hive and a .reg file?

A hive is the binary on-disk database. A .reg file is a plain-text export in a human-readable key/value syntax, produced by regedit for import elsewhere.

Can deleted registry keys be recovered?

Frequently, yes. Deletion marks a cell as free rather than overwriting it, so unallocated space inside a hive often still contains intact key and value records.

Which timestamp does a key store?

The last-write time of the key itself, as a 64-bit FILETIME. Individual values carry no timestamp, so a value change is dated only by its parent key.

Windows Registry Hive Decoder

Parse Windows registry hive structures, keys, values and timestamps.

on the roadmapFile Format & Archivesfree · no sign-up

This bench is being wired up

The registry-hive-decoder decoder is on the roadmap. The heavier binary and cryptographic parsers ship after the core text and token decoders — all of which are already live and working.

Browse the live decoders

Input is processed on your device. Nothing you paste is sent anywhere.

What is the Windows Registry Hive Decoder?

A registry hive decoder parses the binary structure of a Windows registry file — its regf header and hbin cell blocks — into the tree of keys, values and last-write timestamps it stores.

A registry hive is a small database. It begins with a 4 096-byte regf header, followed by hbin blocks containing cells: nk cells are keys, vk cells are values, and sk cells hold security descriptors. Each key records a last-write timestamp as a 64-bit Windows FILETIME, which is what turns the registry into a forensic timeline.

The hives that matter live in %SystemRoot%\System32\config — SYSTEM, SOFTWARE, SAM and SECURITY — plus NTUSER.DAT in each user profile and UsrClass.dat for per-user COM and shell data. Between them they record installed software, USB device history, network profiles, run keys, and the ShellBags and MRU lists that reconstruct what a user opened and when.

Deleted keys are often still recoverable: the registry marks cells as free rather than wiping them, so unallocated space in a hive frequently contains readable remnants.

Windows Registry Hive Decoder at a glance

Header: regf signature, 4 096-byte header block
Cells: nk keys · vk values · sk security descriptors
Timestamps: 64-bit Windows FILETIME per key
Main hives: SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT

How to use the Windows Registry Hive Decoder

1Load the hive file — a .DAT, a config hive or an exported fragment.
2Browse the decoded key tree and the values under each key.
3Read the last-write timestamps to build a timeline of changes.

When you would reach for it

Reconstructing USB device connection history during an investigation.
Recovering installed-software and run-key persistence data from an image.
Reading a hive fragment when no Windows machine is available.

Windows Registry Hive Decoder — frequently asked questions

Last reviewed 25 July 2026 · questions or corrections: contact@decoder.tools