MS-Windows

This article describes the MS-Windows 9X Registry and provides a comparison between it and .ini files. Topics covered include the structure of the Registry, making changes to the Registry using REGEDIT, and backing up, restoring, and compacting the Registry.

The Windows 9x Registry

The Registry was designed to replace the Win 3.x .ini files used by 16-bit applications. Win9x ostensibly supports ini's only for compatibility with older programs, but some Windows 9x Control Panel applets exclusively use ini's (Leonard & Simon).

The Windows Registry is a central repository for configuration information about your computer system. It contains information about:

  • Hardware - database of installed devices, their required resources, driver info, settings
  • OS - Windows settings, desktop, Start Menu, shortcuts, etc.
  • Applications -32-bit application options and settings

Comparison between .INI files and Registry

INI filesRegistry
ManifoldTwo files that look like one file in REGEDIT
Scattered aboutOne location: C:\WINDOWS
Text filesBinary
No specific toolsSpecial editor with search function

Advantages and Disadvantages

Configuration information is

  • More centralized
  • More secure (binary)
  • Easier to search (binary)

The registry is versatile because information is centralized and easily searchable, and because binary file structures use "pointers" to make logical connections between sections. This makes it easier to implement features such as user profiles and system policies to configure hardware and software.

On the other hand, binary files tend to be more fragile than text files because of the devastating effects of corruption upon them.

Registry Files

Although the Registry is logically one file, it is actually composed of two different files, three if the machine is networked and using system policies.

C:\Windows\USER.DAT

During Windows Setup, the User.dat file is automatically stored as a hidden file in the Windows folder, but the file does not necessarily remain there. If User profiles are enabled, users can have their own settings stored in the Windows\Profiles folder.

In a network setting, this file may be located on a central server.

User.dat contains user-specific information, including:

  • Logon Name
  • Desktop settings
  • Wallpaper, color scheme, mouse options, etc.
  • Shortcuts and Start Menu settings
  • Explorer options

C:\Windows\SYSTEM.DAT

The System.dat file is always stored as a hidden file on the local computer in the Windows 98 folder.

The System.dat file contains hardware-specific or computer-specific settings (the hardware profile), including:

  • Hardware devices, their resources, settings, and driver information
  • Settings for Windows and 32-bit applications

Policy.pol

Unlike System.dat and User.dat, the Policy.pol file is not a mandatory component of a Windows 98 installation.

System policies override settings which are contained in the other two registry files.

System policies can provide additional information specific to a network and are used most often to place limits on users' computer environments.

Registry Structure

The Registry is arranged in a hierarchy with six entries in the top level.

These six top level entries are referred to as root keys, hkeys, or handle-keys. Their names all begin with "hkey".

Notice that some of the root keys are actually aliases for subsets of other root keys:

Root key File Data Alias For
Hkey_users User.dat Sounds; certain ctrl-panel settings keyboard layout); network settings; DUN; 32-bit application settings  
Hkey_current_user User.dat Generic user information for new users and user-specific information, such as desktop settings. For user currently logged in: either hkey_users\defaultor (with profiles)hkey_users\username. hkey_users\default or, when profiles are in use hkey_users\username
Hkey_local_machine System.dat Non-user specific: installed hardware and software settings.  
Hkey_classes_root System.dat File associations; OLE links; DDE information; shortcuts; other interface features hkey_local_machine\software\classes
Hkey_current_config System.dat Settings for current hardware profileYour computer's hardware configuration. When profiles are in use:hkey_local_machine\config\current
Hkey_dyn_data System.dat Data which needs to be in ram at all times for fast access. PnP devices attached to your computer.  

Beneath the hkeys are subkeys where specific settings are assigned.

REGEDIT.EXE

Regedit, the Win 9x registry editor, provides a way to find specific keys and then delete, modify, or add settings to them.

Regedit32.exe is the regedit program which comes with Win NT and Win 2000. In addition to possessing the capabilities of Regedit, Regedit32 can create, edit, and delete user profiles and system policies in a networked environment.

Regedit also exports and imports all or parts of the registry, which is one way to back-up the registry. The registry itself is in a binary format, but when it is exported it is written as a text file.

One way to modify the registry is to export it, modify the exported file in a text editor, and then save it. The modified text file can then be import back into the registry using Regedit. Furthermore, Regedit can automatically import and export based on command line parameters. Using this method to edit the registry is especially advantageous when a value must be changed in many places in the registry because you can use the search and replace function of a text editor.

Caution! Text files exported from Regedit have the extension .REG. Double-clicking on a file with the .REG extension is a short-cut to Importing that file into the Registry. Some applications use .REG files as a way of distributing registry changes for their installation so never click indiscriminate on REG files - they may damage your system's Registry.

There are two panes in Regedit. The hierarchy of keys is displayed in the left-hand pane while the names and values for key setting appear in the right-hand pane.

In the right-hand pane there are two columns. The type of value, which can be either a character string, binary number, or double-word, is identified by an icon beside the name of the setting, which is in the first column. The actual value for the setting, the data, appears in a column to the right of the setting name.

Three types of data in the Registry (Leonard & Simon):

  • Strings (starts out with a zero-length string)
  • Binary value starts out as: (zero-length binary data)
  • Dword, or double-word (starts out as: 00 00 00 00, four bytes of zeros)

(The difference between binary and double-word is that double-word is fixed length and binary is variable length).

To change a registry setting, begin by locating its key. Do this either by using the Find function or by manually navigating the hierarchy if you know where the key is located. To use the Regedit search function to locate a key, value, or data, press Ctrl-F, type a search string in the find field, and press Enter or click on Find Next.

After locating the key for the setting you wish to modify, double-click the name of the setting in the right-hand pane and edit the name and/or data in the dialogue box.

To add a subkey or a setting to a key, right-click the key and make the appropriate selection from the context-sensitive menu.

Example of removing data from the Registry

Removing a program from Add/Remove programs list after is has been uninstalled.

Go to:

Kkey_local_machine\Software\Microsoft\Windows\CurrentVersion\Uninstall

Remove the entire key for the nonfunctioning entry.

How to add a new value to the Registry

  • Select key
  • Edit, New
  • Pick data type (string, binary, dword)
  • Type in Name of value
  • Hit Enter twice to bring up the REGEDIT edit box
  • Type in data

Backing up the Registry

Backing up the Windows 95 Registry

The Registry is backed up each time a change is made to it. Windows copies it to SYSTEM.DA0 and USER.DA0. This does not offer a great deal of protection because a good backup may be written over by a bad copy before you realize that there is a problem.

The Registry is Window's most critical file, so MicroSoft provided two special programs to safeguard it in Windows 95:

Configuration Backup utility (CFGBACK.EXE)

CFGBACK.EXE is found on the \other\misc\cfgback folder of Win95 CD.

Unfortunately CFGBACK has bugs in it that prevent it from restoring the Registry correctly (Unleashed; p.495).

Emergency Recovery Utility (ERU)

The ERU is found in the \other\misc\eru folder of Win95 CD.

Unfortunately ERU has an anomaly which keeps it from working properly if your system does not have one or more of the 8 files that it backs up unless you modify its .INF file by commenting out the file(s) not on your system. This means that you would have to remember to go back to that file and uncomment the section if your system subsequently acquired that file (an autoexec or config.sys, for example) before the file would be backed up.

More reliable methods to backup the Win95 Registry include:

  • The Registry Editor, which can Export and Import the Registry or parts of it
  • Third-party utilities that backup the Registry
  • DOS commands (attrib and copy), preferably in a batch file

Backing up the Win98 Registry

The first time each day that the system boots successfully, the Windows 98 Registry Checker makes a backup copy of the Registry.

In addition, each time you restart your computer, the Registry Checker automatically scans your registry. If Registry Checker notices a problem, it automatically replaces the registry with the backup copy.

You can also use the Registry Checker (SCANREG.EXE) to manually backup or restore the Registry at any time.

To manually back up the Registry, start the Registry Checker.

   RUN SCANREG.EXE
   or
   Start>Programs>Accessories>System Tools>System Information>Tools>Registry Checker

Note: if your registry contains an entry referencing a file that no longer exists (such as a .vxd file), it will not be fixed by Registry Checker. (Windows Help)

Restoring the Registry

Restoring the Windows 95 Registry

Two methods can be used to restore the Registry in Windows 95:

You can either use DOS commands from either the command line or in a batch file to overwrite damaged Registry files with good ones. See backup and restore batch files in Handouts section.

Important Note: this method must be done from pure DOS (no GUI in memory) otherwise Reg is open and cannot be copied over. Reboot, F8, choose Command Prompt Only or boot from a system diskette.

In a similar fashion, you can use DOS commands to force Windows 95 to automatically replace the Registry at bootup. If something happens to your system's Registry that makes it unusable, you can try to restore the Registry to its state when you last successfully started Windows 95 (SYSTEM.DA0). To do so, follow these steps:

  1. Restart the computer. When you see the "Starting Windows 95" message, press the F8 key, then choose "Safe mode command prompt only" from the Startup menu.
  2. Type the following command to move to the Windows folder: cd \windows
  3. Type the following line: attrib -s -h -r system.dat
  4. Type the following line: ren system.dat system.bad
  5. Restart your computer. Windows 95 uses the System.da0 file when it cannot find the System.dat file. If this file works, Windows 95 renames it to System.dat.

Restoring the Windows 98 Registry

To manually restore the Windows 98 Registry, use the SCANREG utility.

As mentioned above, a backup of the Registry is made automatically during the first boot of any day. (You can also force this backup by running scanreg.exe. at anytime as noted above).

The five most recent of these backups are kept in the (hidden) folder: c:\ windows\sysbckup. The backups carry the names rbnnn.cab where nnn is the number of the backup. The higher the number nnn is, the more recent the backup is.

You can restore one of these backups by booting to a Command Prompt Only, or using a system diskette, and giving the command SCANREG /RESTORE. Scanreg will offer the available backups and restore the one that you choose.

Some sources mention the use of the Microsoft program RegBack.exe. It is supposed to make any number of backups with a name chosen by the user. If you can find it.

Compacting the Registry

From Windows95 Annoyances web site.

Over time the Registry can become quite large, larger than necessary in fact. This is partly due to the nature of databases and partly because in an effort to improve performance (i.e. reduce the amount of time Windows9x spends reading and writing to the Registry), deleted items aren't necessarily removed from the Registry files. This means that your Registry eventually becomes bloated with unused entries and empty space. Compacting a database rewrites the entire file with only the information that is being used - resulting in a smaller file and a quicker boot.

Here's how to compact the registry:

Important: back up Registry first!

Open the Registry Editor

Select the "root" (usually called My Computer), and select Export from the File menu.

  1. Change to your root directory (usually C:\), specify a filename with the REG extension (if you've configured Windows9x to show your extensions), such as COMPACT.REG, and click OK.
  2. Restart Windows in MS-DOS mode
  3. Change to your Windows directory using the CD command (in most cases, type "CD \WINDOWS" at the prompt).
  4. Unhide the Registry files by typing the following commands:

    
             ATTRIB -r-a-s-h SYSTEM.DAT 
             ATTRIB -r-a-s-h USER.DAT. 
          
  5. Now, have REGEDIT rebuild your registry by typing the following command (make sure you replace COMPACT.REG with whatever you specified above): REGEDIT /C C:\COMPACT.REG

Unless you receive an error at this point (such as "CAN'T ACCESS REGISTRY"), the registry is compacted and you're finished.

If you did get an error, don't panic. If you've backed up the registry (as directed above), you can still recover it. However, you might still be able to start Windows in its current state - again, don't worry if it appears as though Windows95 has forgotten all your settings.

If you're able to get back into Windows95, just open Explorer, find the COMPACT.REG file you created, and double-click on it. After a few seconds, you should see a message like "Information in C:\COMPACT.REG has been successfully entered into the registry." When you see this, restart Windows95 immediately, and everything should be fine.

If you can't get back into Windows95, you'll have to restore the backup you made beforehand. It is unknown at this point why the DOS version of the Registry Editor gives this error.


Bruce Miller, 2001, 2014