Where Are Windows Registry Hive Files Located on Disk

The Windows Registry stores essential operating system settings, hardware configurations, and application preferences within low-level binary database files called hives. When you launch the Registry Editor (Regedit), it does not view a single unified file; instead, it compiles and presents multiple discrete hive files residing on your storage drive into a structured, hierarchical tree. This guide provides the exact file paths on disk for the core system hives—including SAM, SYSTEM, and SOFTWARE—explains their corresponding nodes in Regedit, and outlines how Windows manages access to them.

The Standard Directory for System Registry Hives

The primary system hives, including SAM, SYSTEM, and SOFTWARE, are stored in the following directory on the drive where Windows is installed:

C:\Windows\System32\config\

(Note: If Windows is installed on a different drive or directory, replace C:\Windows with your %SystemRoot% path).

File Names and Their Regedit Mappings

Inside the C:\Windows\System32\config\ folder, the hive files do not have file extensions. Regedit maps these specific files to keys under HKEY_LOCAL_MACHINE (HKLM):

• SOFTWARE
  • Disk Path: C:\Windows\System32\config\SOFTWARE
  • Regedit Path: HKEY_LOCAL_MACHINE\SOFTWARE
  • Description: Contains configuration data for installed third-party software, Windows components, and system-wide application settings.
• SYSTEM
  • Disk Path: C:\Windows\System32\config\SYSTEM
  • Regedit Path: HKEY_LOCAL_MACHINE\SYSTEM
  • Description: Stores critical startup and operating system configuration data, device drivers, control sets, and hardware profiles.
• SAM (Security Accounts Manager)
  • Disk Path: C:\Windows\System32\config\SAM
  • Regedit Path: HKEY_LOCAL_MACHINE\SAM
  • Description: Stores local user account credentials, password hashes, and local security policy information.

Related System Hives in the Same Directory

The C:\Windows\System32\config\ directory also houses other essential registry hives:

• SECURITY: Located at C:\Windows\System32\config\SECURITY (maps to HKEY_LOCAL_MACHINE\SECURITY). Stores local security policies and domain trust information.
• DEFAULT: Located at C:\Windows\System32\config\DEFAULT (maps to HKEY_USERS\.DEFAULT). Used as the profile template for system services and the login screen.

Supporting Transaction and Log Files

Along with the main hive files, the config directory contains supporting files sharing the same base name, such as:

• .LOG, .LOG1, .LOG2: Transaction log files used by Windows to ensure data integrity and roll back incomplete changes if an unexpected shutdown occurs.
• .TM and .TMContainer: Transaction manager files supporting transactional registry operations.

File Locking and Access Considerations

When Windows is active, the operating system kernel maintains exclusive, low-level locks on the SAM, SYSTEM, and SOFTWARE files. Consequently:

• You cannot open, modify, overwrite, or delete these files using standard file-management tools (like File Explorer or Notepad) while Windows is running.
• Modifications must be made through the Windows Registry APIs, PowerShell, Command Prompt, or Regedit.
• To extract or back up these files directly from disk while the system is online, administrators typically use tools that leverage the Volume Shadow Copy Service (VSS) or native utilities such as the reg save command (for example, reg save HKLM\SYSTEM C:\Backup\SYSTEM).