Named Key cells are the data structures within the Registry that hold the Keys and provide the parent/child data necessary to build the tree. Different documentation calls these Named Keys, Node Keys, or NT Keys. It is unclear which is correct, so I’m going to go with Noodle Keys.   offset length type what is […]

The contents of Registry files are saved in Hive Bins. The previously mentioned header to the Registry file is a 4k block with info about the file as a whole. After that comes a series of blocks that each start with magic signature of “hbin”. These blocks are the containers that all the keys, values, and everything […]