NTUSER.DAT — User Registry Hive

NTUSER.DAT is the single most information-dense forensic artifact in a Windows user profile. This per-user registry hive records program execution history (UserAssist), typed file paths and URLs (TypedPaths, TypedURLs), recently accessed documents (RecentDocs), mapped network drives, persistence mechanisms (Run/RunOnce keys), and hundreds of software configuration settings that collectively reconstruct a comprehensive picture of user activity.

What Is NTUSER.DAT?

Every Windows user profile contains a file named NTUSER.DAT in the root of the user’s profile directory (C:\Users\{username}\NTUSER.DAT). This file is a registry hive — a binary container in the regf (registry file) format — that is loaded into the HKEY_CURRENT_USER (HKCU) registry tree when the user logs on. All user-specific registry keys written under HKCU during the session are persisted to NTUSER.DAT when the user logs off or when the system performs periodic hive flushes.

NTUSER.DAT is distinct from the system-level registry hives (SAM, SECURITY, SYSTEM, SOFTWARE) stored in C:\Windows\System32\config\. It contains only user-scoped data: application settings, shell preferences, recent file lists, execution history, and persistence entries that apply to that specific user account. A companion hive, UsrClass.dat (located at C:\Users\{user}\AppData\Local\Microsoft\Windows\UsrClass.dat), contains additional user-specific COM class registrations and ShellBags data.

For forensic investigators, NTUSER.DAT is invaluable because it consolidates dozens of evidence types into a single file. Rather than searching for individual artifacts scattered across the filesystem, an investigator can extract NTUSER.DAT and parse it to obtain execution history, file access patterns, persistence mechanisms, network drive mappings, and software configurations in one pass.

Location & Format

Registry Hive Format (regf)

The regf format organizes data into 4096-byte blocks called bins. Each bin contains cells that store keys, values, security descriptors, and subkey lists. The format includes a header with a sequence number, timestamp, and checksum. Transaction logs (.LOG1, .LOG2) use a write-ahead logging model similar to ESE databases: writes are first journaled in the log files, then committed to the main hive. Forensically, the log files may contain more recent data than the main hive if the system was not cleanly shut down.

Key Forensic Subkeys

NTUSER.DAT contains hundreds of subkeys, but the following are the most forensically valuable. Each maps to the HKCU\ namespace (the NTUSER.DAT\ prefix is used when analyzing the hive offline):

UserAssist Deep Dive

UserAssist is one of the most powerful execution artifacts in Windows forensics. Located at NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\UserAssist\, it contains two GUIDs:

• {CEBFF5CD-ACE2-4F4F-9178-9926F41749EA} — Tracks executable file execution (EXE files launched via Explorer shell)
• {F4E57C4B-2036-45F0-A9AB-443BCFE33D9F} — Tracks shortcut file (LNK) execution

Each value name under these GUIDs is the full path to the executed program or shortcut, encoded with ROT-13 (a simple letter substitution cipher that shifts each letter 13 positions). For example, P:\Hfref\wqbr\Qbjaybnqf\zpyvrag.rkr decodes to C:\Users\jdoe\Downloads\mclient.exe. The ROT-13 encoding is trivially reversible and is not a security measure — it simply prevents casual registry browsing from revealing the data.

Each UserAssist value contains a 72-byte binary data structure (Windows 7+) with the following fields:

What It Reveals

NTUSER.DAT answers an exceptionally broad range of investigative questions:

• Which programs did the user execute via the GUI? — UserAssist records execution path, run count, focus time, and last execution timestamp for every program launched through Explorer.
• What paths did the user type into Explorer? — TypedPaths records UNC paths, local paths, and environment variables entered into the Explorer address bar — proving the user intentionally navigated to a location.
• What documents did the user recently open? — RecentDocs tracks files by extension with MRU ordering. OpenSavePidlMRU tracks files accessed through common file dialogs (Open/Save).
• What commands did the user type into the Run dialog? — RunMRU captures Win+R commands including cmd, powershell, \\server\share, and application names.
• What persistence mechanisms exist for this user? — Run and RunOnce keys list programs that auto-start at this user’s logon. Malware frequently writes to these keys.
• What network shares or removable media did the user access? — MountPoints2 records every volume and UNC path the user mounted, including USB drives, network shares, and ISO/VHD mounts.
• What mapped network drives were configured? — The Map Network Drive MRU and Network subkey show persistent and recent network drive mappings.
• How long did the user actively use a program? — UserAssist FocusTime provides total foreground usage duration in milliseconds.

Forensic Use Cases

1. Proving Intentional Access to Restricted Data

An employee claims they “accidentally” accessed a restricted network share containing executive compensation data. NTUSER.DAT’s TypedPaths key contains the entry \\HRSERVER\Exec_Comp\2026, proving the user manually typed the UNC path into Explorer’s address bar rather than clicking a link or shortcut. The MountPoints2 key confirms the share was mounted. RecentDocs shows .xlsx files from that directory in the MRU list. UserAssist shows Microsoft Excel was executed 3 minutes after the TypedPaths entry was created.

2. Identifying Persistence After Malware Removal

Endpoint detection removed a malicious executable from disk, but the system re-infects after every reboot. The Run key at NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run contains a value named WindowsUpdate pointing to C:\Users\{user}\AppData\Roaming\svchost.exe. The EDR removed the executable but did not clean the registry persistence key. Every logon, the system attempts to execute the deleted binary — and if the malware has a dropper component elsewhere, it recreates the file.

3. Reconstructing Deleted File Access History

A user deleted their browser history and emptied the Recycle Bin. However, NTUSER.DAT’s RecentDocs key retains MRU-ordered entries for recently opened files, including documents that have been deleted. The OpenSavePidlMRU key shows that the user saved files to F:\USB_Export\ via a Save As dialog in a document editor. The LastVisitedPidlMRU key links the specific application to the directory it last visited, proving which application was used to save files to the USB drive.

4. Insider Threat Timeline

UserAssist data is extracted from three months of VSS snapshots of NTUSER.DAT, revealing that a departing employee’s usage of WinSCP (an SFTP client) increased from 0 executions to 47 executions in the final two weeks of employment. The FocusTime field shows 14 hours of active use. TypedPaths shows the employee typed \\FILESERVER\Engineering\Designs into Explorer 23 times during the same period. MountPoints2 shows a new USB device (volume GUID not previously seen) was first mounted one week before the resignation notice.

5. RunMRU as Evidence of Technical Sophistication

In an unauthorized access investigation, the RunMRU key reveals commands like cmd /k whoami /priv, powershell -ep bypass, and regedit. These entries prove the user executed administrative commands through the Run dialog, demonstrating technical intent and capability beyond a typical end user. The MRU order reconstructs the sequence of commands, and the key’s last-write timestamp provides a time anchor.

Acquisition Methods

Live System — Volume Shadow Copy

:: Create a Volume Shadow Copy
vssadmin create shadow /for=C:

:: Copy NTUSER.DAT and transaction logs from the shadow copy
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\Users\jdoe\NTUSER.DAT C:\Evidence\
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\Users\jdoe\ntuser.dat.LOG1 C:\Evidence\
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\Users\jdoe\ntuser.dat.LOG2 C:\Evidence\

:: Also collect UsrClass.dat
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy3\Users\jdoe\AppData\Local\Microsoft\Windows\UsrClass.dat C:\Evidence\

Live System — KAPE / Raw Copy

:: KAPE target for registry hives
kape.exe --tsource C: --tdest C:\Evidence\KAPE_Output --target RegistryHives

:: RawCopy for locked file access
RawCopy.exe /FileNamePath:C:\Users\jdoe\NTUSER.DAT /OutputPath:C:\Evidence\

:: Velociraptor collection
:: Artifact: Windows.KapeFiles.Targets with target "RegistryHives"

Forensic Image — Direct Extraction

# Mount forensic image read-only
mount -o ro,noexec,nodev /dev/sdb1 /mnt/evidence

# Copy NTUSER.DAT and logs for all users
for user in /mnt/evidence/Users/*/; do
    uname=$(basename "$user")
    mkdir -p /analysis/registry/"$uname"
    cp "$user"NTUSER.DAT /analysis/registry/"$uname"/ 2>/dev/null
    cp "$user"ntuser.dat.LOG* /analysis/registry/"$uname"/ 2>/dev/null
    cp "$user"AppData/Local/Microsoft/Windows/UsrClass.dat /analysis/registry/"$uname"/ 2>/dev/null
done

Parsing Tools & Analysis

Parsing with RECmd (Batch Mode)

:: Parse NTUSER.DAT using the built-in batch file for all forensic keys
RECmd.exe -f C:\Evidence\NTUSER.DAT --bn RECmd\BatchExamples\RECmd_Batch_MC.reb --csv C:\Analysis\RECmd_Output

:: Output files include parsed UserAssist, TypedPaths, RecentDocs,
:: Run keys, MountPoints2, and many more forensic artifacts

Parsing with RegRipper

# Run all NTUSER.DAT plugins
rip.pl -r /analysis/registry/jdoe/NTUSER.DAT -f ntuser > /analysis/rr_ntuser_output.txt

# Run specific plugins
rip.pl -r /analysis/registry/jdoe/NTUSER.DAT -p userassist
rip.pl -r /analysis/registry/jdoe/NTUSER.DAT -p typedpaths
rip.pl -r /analysis/registry/jdoe/NTUSER.DAT -p recentdocs
rip.pl -r /analysis/registry/jdoe/NTUSER.DAT -p run

UserAssist Decoder Script

import codecs, struct, datetime
from Registry import Registry

reg = Registry.Registry('/analysis/registry/jdoe/NTUSER.DAT')
ua_key = reg.open('Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\UserAssist')

for guid_key in ua_key.subkeys():
    count_key = guid_key.subkey('Count')
    for val in count_key.values():
        # Decode ROT-13 name
        name = codecs.decode(val.name(), 'rot_13')
        data = val.value()

        if len(data) >= 72:
            run_count = struct.unpack_from('<I', data, 4)[0]
            focus_count = struct.unpack_from('<I', data, 12)[0]
            focus_ms = struct.unpack_from('<I', data, 16)[0]
            filetime = struct.unpack_from('<Q', data, 60)[0]

            if filetime > 0:
                ts = datetime.datetime(1601,1,1) + datetime.timedelta(microseconds=filetime//10)
            else:
                ts = 'N/A'

            if run_count > 0:
                print(f'{name}')
                print(f'  Runs: {run_count}  Focus: {focus_count}  FocusTime: {focus_ms/1000:.0f}s  Last: {ts}')
                print()

Retention & Persistence

Anti-Forensics Resilience

NTUSER.DAT has a mixed anti-forensics resilience profile. Some subkeys are targeted by cleanup tools while others are almost never cleared.

MITRE ATT&CK Detection Mapping

NTUSER.DAT data provides evidentiary support for detecting the following MITRE ATT&CK techniques:

Related Artifacts & Cross-References

Corroborating Artifacts

References

1. Eric Zimmerman, “Registry Explorer & RECmd” — https://ericzimmerman.github.io/
2. Harlan Carvey, “RegRipper — Registry Analysis Tool” — https://github.com/keydet89/RegRipper3.0
3. Didier Stevens, “UserAssist” — https://blog.didierstevens.com
4. SANS Institute, “Windows Registry Forensics” — https://www.sans.org/blog/
5. 13Cubed, “NTUSER.DAT Analysis for DFIR” — https://www.13cubed.com/blog
6. Microsoft, “Registry Hive Format” — https://learn.microsoft.com
7. ForensicArtifacts.com, “NTUSER.DAT Artifact Definition” — https://github.com/ForensicArtifacts/artifacts
8. Maxim Suhanov, “yarp — Yet Another Registry Parser” — https://github.com/msuhanov/yarp