Back to 7/96 Enterprise Windows: Product Pipeline
Up to Table of Contents
Ahead to 7/96 Features: Unlock the Registry's Secrets

7/96 Features: Unlock the Registry's Secrets

Windows 95 keeps your system settings
safe and sound. But it's inevitable--you'll
want to make changes here and there.
Before you do, you'll need the keys to the Registry.

By Karen Kenworthy

It's never been easy for your computer to keep track of the myriad settings and preferences you can request. Some early computers relied on toggle switches to record simple settings. Later, small amounts of configuration data were stored on punched cards or paper tape.

Looking back, it's no wonder that .INI files, introduced by Microsoft with the release of Windows 1.0, were welcomed with open arms. Windows standardized the use of specialtext files, most notably WIN.INI and SYSTEM.INI, to record information about the computer's hardware configuration, fonts, color schemes, file associations, high game scores and more. Windows applications followed this example, storing a variety of settings and preferences in .INI files. Many apps stored their data in WIN.INI. But many other programs created .INI files of their own-and scattered them all over our hard disks.

The increasing number of .INI files and their unpredictable locations made it difficult for applications and application add-ons to work together. The .INI file design itself was also beginning to reveal some serious limitations. Internally, .INI files consist of several sections, each containing one or more value entries. A value entry has two parts: a value name and the actual value. Unfortunately, these values must be pure text-no unprintable characters, or binary data, permitted. And values have to be short. An entire .INI file can contain no more than 64KB of characters, severely limiting the types of data they can contain.

But section-based arrangement soon became .INI files' biggest limitation. Conceived as a way to organize data, the two-level data hierarchy may have been a mile wide, but it was only an inch deep.

Registry to the Rescue

For all these reasons, the designers of Windows NT, and later Windows 95, were eager to replace .INI files with something better. A powerful, system-wide database known as the Registry emerged from their brainstorming sessions. All information previously kept in .INI files, and a whole lot more, is now stored in the Registry. Its setup makes data storage and retrieval more reliable, flexible and convenient.

The Registry is an important step toward the future of Windows computing. As a single data repository, it promotes sharing of Windows and application information. In future releases of Windows, Microsoft will merge current Registry information, file system details and more into a single system database.

Just like its .INI file ancestors, the Registry stores data in two parts: a value name and the actual value. But Registry data can store binary information such as images and icons. And while Registry values are each limited to 64KB in size, the Registry itself can be as large as is necessary.

The Registry also allows its data to be organized into a multilevel hierarchy. Borrowing heavily from the design of a hard disk's file system, the Registry allows related data entries to be gathered into groups or squirreled away in obscure corners.

The Key to the Tree

Click Here to see a 20.2KB bitmap image of artwork which goes with this article, entitled:
Registry's Data Tree

You can see the Registry's organization for yourself with a program called Registry Editor. You won't find it on your Start menu, but you can run it by selecting Run from the Start menu and entering the program's name: regedit.exe.

The Registry Editor's main window looks a lot like Explorer in Windows 95, with a graphical representation of the Registry's data hierarchy in the left pane. Think of the data hierarchy as a tree. Click on the plus sign next to a branch, and you'll see its offshoots. Click on the minus sign next to a branch, and lower-level portions of the tree will temporarily disappear.

The trunk of the Registry's data tree appears at the top of the display and is labeled My Computer. Six branches known as HKEYs appear beneath it. HKEY stands for "Handle to a KEY," a phrase and acronym that never should have been allowed to escape from the cellars and attics where programmers invent new terms.

The three most important HKEYs are HKEY_LOCAL_MACHINE, HKEY_USERS and HKEY_DYN_DATA. All of the Registry's data is stored beneath these three main branches. The other HKEYs are merely aliases for portions of the data tree beneath the three main HKEYs, and in fact, they aren't really needed. HKEY_LOCAL_MACHINE and its sub-keys lead to all data entries related to your computer's hardware, drivers and systemwide software settings. For example, the current hardware configuration, detected by Windows 95's Plug-and-Play software and displayed by Device Manager, is stored at HKEY_LOCAL_MACHINE\Enum. The sub-keys beneath HKEY_LOCAL_MACHINE\Software lead to many of the settings of most 32-bit applications, and Windows itself.

As its name suggests, HKEY_USERS leads to data about individual computer users. This information includes your personal Windows preferences such as wallpaper, color scheme and desktop fonts, plus personal application settings like Most Recently Used file lists and toolbar contents.

If your computer is attached to a network, or if you've enabled User Profiles (see Power Windows in this issue), you'll find this information stored under a sub-key named after each person's user name. For example, if someone logs onto your computer by entering the user name "Bob," his information will be stored under HKEY_USERS\Bob. There's also a sub-key, HKEY_USERS\.Default, used to store the settings of folks who don't use a name when they log on, and as a template for new users' settings.

Finally, there's HKEY_DYN_DATA. The information stored under its sub-keys is subject to change at any moment-hence the name, which is short for Dynamic Data. In addition to the current status of each part of your computer's hardware configuration, you'll also find the real-time performance statistics reported by Windows 95's System Monitor.

HKEY_CLASSES_ROOT is a holdover from Windows 3.1. Not many people know that Windows 3.1 has a Registry that holds information needed to support drag-and-drop and OLE. This same information is now found in the Win95 Registry at HKEY_LOCAL_MACHINE\Software\Classes. The HKEY_CLASSES_ROOT alias exists only to provide compatibility with older programs that directly accessed the Windows 3.1 Registry.

The remaining HKEYs duplicate data stored under HKEY_LOCAL_MACHINE and HKEY_USERS. For example, HKEY_CURRENT_USER contains the same information found in HKEY_USERS\<user name>, where <user name> is the current log-on name (or .Default if no user has logged on). HKEY_CURRENT_CONFIG is an alias for HKEY_LOCAL_MACHINE\Config\<config num>, where <config num> is a number that indicates the current hardware configuration. This number is usually 0001, but may be a higher number if you've created alternate hardware configurations using Windows 95's Device Manager.

Data Details

Now let's take a look inside the sub-keys of the Registry. Click once on any of the sub-keys appearing in the Registry Editor's left pane. You'll see data stored in that location in the editor's right pane, along with the value's name and an icon indicating the type of data (binary or text). The icons for text data show the letters "ab" in red, while the binary data icon includes the digits "011 110" in blue. Text data (also known as string) values are displayed inside a pair of quotation marks, while binary data values are shown in hexadecimal notation (preceded by the C language hexadecimal identifier "0x"). When possible, the decimal value of a binary value is shown, too, inside parentheses.

To make changes to the Registry, double-click on the appropriate data name in the editor's right pane. That brings up a window where a new value can be entered. You can also delete a data entry by clicking once on its data name, then pressing the Delete key or selecting Delete from the editor's Edit menu.

To add a new data entry to an existing sub-key, select the sub-key by clicking once on its name in the editor's left pane. Then select New from the editor's Edit menu. Finally, select a data type from the list provided: string, binary or DWORD (a special type of binary data that's limited to 32 bits or four bytes). New data entries are automatically given the name "New Value 1" as well as a value of "" if string, a zero-length binary value if binary, or zero if DWORD. Once you create the entry, you can change its name by right-clicking on the current name and selecting Rename from the Context menu.

Behind the Scenes

The designers of the Registry have taken several steps to protect their valuable information repository. The Registry is first and foremost a place where programs store data and communicate with one another. Although we humans can visit, we're never entirely welcome. There's just too much mischief we can get into if we're not careful.

The Registry appears to be a single database, but the information it contains is actually stored in three different locations. The data found under HKEY_LOCAL_MACHINE is stored in a file named SYSTEM.DAT, while the information beneath HKEY_USERS is kept in a file named USER.DAT. The real-time data shown under HKEY_DYN_DATA is never stored on disk. Instead, it's always kept in RAM, where it can be updated more quickly.

One sign of the designers' concerns is the special nature of SYSTEM.DAT and USER.DAT. For protection, both files have the Hidden and System attributes set. But astonishingly, both files are also marked Read-Only. Windows cheats and can write to either file at will (it's nice to be the operating system). But you and I are prevented from making direct changes to these files. We rely on tools like the Registry Editor.

Locating SYSTEM.DAT and USER.DAT can be a bit tricky. If Windows has been installed on your boot drive, you'll find SYSTEM.DAT in the directory where Windows was installed (usually C: \WINDOWS). But if you've installed Windows on any other drive, Windows creates a small, hidden \WINDOWS directory on your boot drive and hides the file there.

Normally, USER.DAT can be found alongside SYSTEM.DAT. But if your computer is on a network or if you've enabled User Profiles, things get more complicated. First, you'll find there's more than one USER.DAT file. Windows creates one for each user who has logged onto your computer, plus one more (called the default USER.DAT) for those who use your computer without logging on. The default file is stored in the directory where you installed Windows, while individual users' files are kept in each user's directory. In the case of networked systems with a NetWare or Windows NT server, that directory is often on the server. If not, or if you've enabled User Profiles, the directory is called \WINDOWS\PROFILES\<user name>, where <user name> is the name entered when the user logs on.

Disaster Recovery

Click Here to see a 24.0KB bitmap image of artwork which goes with this article, entitled:
Value Names

Click Here to see a 12.8KB bitmap image of artwork which goes with this article, entitled:
Add, Change and Delete

Wherever SYSTEM.DAT and USER.DAT are found, they are not alone. Both are always accompanied by "backup" Registry files named SYSTEM.DA0 and USER.DA0. Each time Windows 95 starts successfully, it recreates SYSTEM.DA0 by copying SYSTEM.DAT. Windows recreates a particular user's USER.DA0 each time the user logs on by making a complete copy of that user's USER.DAT file.

These backup Registry files can come in very handy should the main Registry files become corrupted. If the corruption keeps Windows 95 from loading, you can restore the Registry information used during the last successful boot by copying SYSTEM.DA0, and the most recent USER.DA0, over SYSTEM.DAT and USER.DAT.

To copy SYSTEM.DA0, first boot your computer to a command prompt by pressing F5 when the message "Starting Windows 95 ..." appears. Next, enter these seven DOS commands:


CD \Windows

Command\Attrib -R -H -S SYSTEM.DAT

Command\Attrib -R -H -S SYSTEM.DA0


Command\Attrib +R +H +S SYSTEM.DAT

Command\Attrib +R +H +S SYSTEM.DA0

The first two commands place you in the directory where the SYSTEM.DAT and SYSTEM.DA0 files are stored. The next two commands remove the Read-Only, Hidden and System attributes from both files. The fifth command performs the copy, while the last two commands restore both files' original attributes.

All commands assume you've installed Windows on your C: drive, in a directory named \WINDOWS. If not, substitute your drive and directory for those shown here. If your SYSTEM.DAT and SYSTEM.DA0 files are stored anywhere but your \WINDOWS directory, add the appropriate path to the filenames.

Copying USER.DA0 over a corrupted USER.DAT is just as easy. The commands shown above will do the job, once you've substituted USER.DAT for SYSTEM.DAT and USER.DA0 for SYSTEM.DA0. Just be sure to copy the latest user's USER.DA0 over the corresponding USER.DAT file.

The cautious Registry designers provided at least two other ways to recover if you can't start Windows because of Registry problems. First, you can bypass most Registry entries by starting Windows 95 in Safe Mode. This may allow you to use Windows' Control Panel and other tools to correct any Registry misinformation. To boot Windows 95 in Safe Mode, press F5 when the message "Starting Windows 95 ..." appears. If this boots your computer to a command prompt, load Windows using the Safe Mode command win /d: m.

If Safe Mode doesn't solve your problem, you can revert to the SYSTEM.DAT file created when you initially installed Windows 95. This file, named SYSTEM.1ST, is in the root directory of your boot drive. You can copy SYSTEM.1ST over SYSTEM.DAT.If no changes have been made to your hardware configuration, this primordial version of the Registry may allow you to boot Windows, though any changes made since Windows was first installed (including information added by applications) will be lost. But with a little luck, you'll be able to run Windows long enough to restore the full Registry from that backup you made last night.

Karen Kenworthy is the author of Visual Basic for Applications, Revealed! (Prima Publishing, 1994), a non-programmer's introduction to VBA. She is also a contributing editor to WINDOWS Magazine and the manager of WINDOWS Magazine's forums on America Online and CompuServe. To find her E-Mail ID Click Here

Back to 7/96 Enterprise Windows: Product Pipeline
Up to Table of Contents
Ahead to 7/96 Features: Unlock the Registry's Secrets