NTUSERDAT

NTUSER.DAT is a per-user registry hive used by Windows to store user-specific configuration and preferences. It resides in a user’s profile directory and contains the portion of the Windows Registry that is loaded as the current user’s HKEY_CURRENT_USER when the user is logged on. In practice, when a user signs in, Windows loads NTUSER.DAT into memory under the user’s security identifier (SID) and maps it so that software and the system can read and write user-specific settings.

Location and scope commonly include C:\Users\<Username>\NTUSER.DAT on modern Windows installations (older systems used C:\Documents and Settings\<Username>\NTUSER.DAT). The file is a binary registry hive; it is accompanied by log files that help preserve integrity during writes. The data stored includes a wide range of user preferences and configurations, such as software settings, desktop and shell preferences, environment variables, and application-specific options. It does not contain system-wide settings, which are kept in other hives like HKEY_LOCAL_MACHINE.

NTUSER.DAT interacts with roaming profiles, where the hive may be downloaded to or uploaded from a network location as part of synchronizing a user’s profile across machines. It can be edited or inspected by registry tools when the hive is loaded for offline analysis or when a user is logged off and the hive is written back to disk.

For administrators and forensic practitioners, NTUSER.DAT is a common source of user-specific information about configuration and activity. Corruption or improper handling can prevent a user profile from loading correctly, making backups and careful management important.