A registry hive decoder parses the binary structure of a Windows registry file — its regf header and hbin cell blocks — into the tree of keys, values and last-write timestamps it stores.
What is the Windows Registry Hive Decoder?
A registry hive is a small database. It begins with a 4 096-byte regf header, followed by hbin blocks containing cells: nk cells are keys, vk cells are values, and sk cells hold security descriptors. Each key records a last-write timestamp as a 64-bit Windows FILETIME, which is what turns the registry into a forensic timeline.
The hives that matter live in %SystemRoot%\System32\config — SYSTEM, SOFTWARE, SAM and SECURITY — plus NTUSER.DAT in each user profile and UsrClass.dat for per-user COM and shell data. Between them they record installed software, USB device history, network profiles, run keys, and the ShellBags and MRU lists that reconstruct what a user opened and when.
Deleted keys are often still recoverable: the registry marks cells as free rather than wiping them, so unallocated space in a hive frequently contains readable remnants.
How to use the Windows Registry Hive Decoder
- Load the hive file — a .DAT, a config hive or an exported fragment.
- Browse the decoded key tree and the values under each key.
- Read the last-write timestamps to build a timeline of changes.
When to use it
- Reconstructing USB device connection history during an investigation.
- Recovering installed-software and run-key persistence data from an image.
- Reading a hive fragment when no Windows machine is available.
Windows Registry Hive Decoder at a glance
| Header | regf signature, 4 096-byte header block |
| Cells | nk keys · vk values · sk security descriptors |
| Timestamps | 64-bit Windows FILETIME per key |
| Main hives | SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT |
Frequently asked questions
What is the difference between a hive and a .reg file?
A hive is the binary on-disk database. A .reg file is a plain-text export in a human-readable key/value syntax, produced by regedit for import elsewhere.
Can deleted registry keys be recovered?
Frequently, yes. Deletion marks a cell as free rather than overwriting it, so unallocated space inside a hive often still contains intact key and value records.
Which timestamp does a key store?
The last-write time of the key itself, as a 64-bit FILETIME. Individual values carry no timestamp, so a value change is dated only by its parent key.
Last reviewed · found a mistake? contact@decoder.tools · view as markdown