%SYSTEMROOT%\system32\config. | Mount point in registry tree | Location | Format |
HKEY_CLASSES_ROOT | Virtual hive | n/a(?) |
HKEY_LOCAL_MACHINE\HARDWARE | Volatile data in memory | n/a(?) |
HKEY_LOCAL_MACHINE\SAM | %SystemRoot%\system32\config\SAM | standard |
HKEY_LOCAL_MACHINE\SECURITY | %SystemRoot%\system32\config\SECURITY | standard |
HKEY_LOCAL_MACHINE\SOFTWARE | %SystemRoot%\system32\config\SOFTWARE | |
HKEY_LOCAL_MACHINE\System | %SystemRoot%\System32\config\SYSTEM | |
HKEY_USERS\user-sid | %USERPROFIE%\NTUSER.DAT | |
HKEY_CURRENT_USER | … | standard |
HKEY_USERS\.DEFAULT | %SystemRoot%\System32\config\DEFAULT | standard |
%SystemRoot%\system32\config\COMPONENTS which seems to be a registry hive that belongs under HKEY_LOCAL_MACHINE. HKEY_CLASSES_ROOT is a virtual hive(?) that merges the values of HKEY_CURRENT_USER\Software\Classes and HKEY_LOCAL_MACHINE\Software\Classes. HKEY_PERFORMANCE_DATA is not stored in a physical hive and not displayed in regedit.exe. HKEY_PERFORMANCE_DATA with WinAPI-Registry functions, Microsoft recommends to use Performance Data Helper (PDH) functions (pdh.dll) to query collected counter data. regedit.exe by using File -> Load Hive. OpenBaseKey of the .NET class Microsoft.Win32.RegistryKey. Microsoft.Win32.Registry class provides top level Microsoft.Win32.RegistryKey objects for the hives' top level keys.