Parsing registry files

Suppose that you have a corrupted registry file, or you need to recover some data, or you want to verify the results of a new analysis tool. All these reasons, besides your need to know how the analysis tools work to parse and recover registry files, make it important to understand the registry file structure.

The registry file consists of blocks with the same concept of clusters in the filesystem. The block size is 4Kb. The hive expands in the whole block, again like the clusters in the filesystem. The first cluster is called the base block.

The base block

The base block is the first 4KB of the hive file. It contains the following:

• The hive signature, which identifies this file as a hive file.

• A timestamp of the last write operation on this hive.

• Checksum.

• The hive format, which differs from one OS version to another. There are differences in how data treated in different versions.

• The real name of the hive file and its full path in the system.

• The offset to the root cell...