# Windows Registry Hive Decoder

> Parse Windows registry hive structures, keys, values and timestamps.

- Page: https://decoder.tools/registry-hive-decoder
- Category: File Format & Archives
- Status: live, runs in the browser
- Last reviewed: 2026-10-23

A registry hive decoder parses the binary structure of a Windows registry file — its regf header and hbin cell blocks — into the tree of keys, values and last-write timestamps it stores.

## What is the Windows Registry Hive Decoder?

A registry hive is a small database. It begins with a 4 096-byte regf header, followed by hbin blocks containing cells: nk cells are keys, vk cells are values, and sk cells hold security descriptors. Each key records a last-write timestamp as a 64-bit Windows FILETIME, which is what turns the registry into a forensic timeline.

The hives that matter live in %SystemRoot%\System32\config — SYSTEM, SOFTWARE, SAM and SECURITY — plus NTUSER.DAT in each user profile and UsrClass.dat for per-user COM and shell data. Between them they record installed software, USB device history, network profiles, run keys, and the ShellBags and MRU lists that reconstruct what a user opened and when.

Deleted keys are often still recoverable: the registry marks cells as free rather than wiping them, so unallocated space in a hive frequently contains readable remnants.

## How to use the Windows Registry Hive Decoder

1. Load the hive file — a .DAT, a config hive or an exported fragment.
2. Browse the decoded key tree and the values under each key.
3. Read the last-write timestamps to build a timeline of changes.

## When to use it

- Reconstructing USB device connection history during an investigation.
- Recovering installed-software and run-key persistence data from an image.
- Reading a hive fragment when no Windows machine is available.

## Windows Registry Hive Decoder at a glance

| | |
|---|---|
| Header | regf signature, 4 096-byte header block |
| Cells | nk keys · vk values · sk security descriptors |
| Timestamps | 64-bit Windows FILETIME per key |
| Main hives | SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT |

## FAQ

### What is the difference between a hive and a .reg file?

A hive is the binary on-disk database. A .reg file is a plain-text export in a human-readable key/value syntax, produced by regedit for import elsewhere.

### Can deleted registry keys be recovered?

Frequently, yes. Deletion marks a cell as free rather than overwriting it, so unallocated space inside a hive often still contains intact key and value records.

### Which timestamp does a key store?

The last-write time of the key itself, as a 64-bit FILETIME. Individual values carry no timestamp, so a value change is dated only by its parent key.