The CD Forum > Win 7 NTUSER.DAT{... files

Full Version: Win 7 NTUSER.DAT{... files

The CD Forum > After Hours > Rest of the World

Ed_P

Oct 18 2011, 11:15 AM

OK, I have a bunch of these files on my C: drive in TWO folders!! C:\Users\Ed and C:\Documents and Settings\Ed. From what I was able to determine from searching the web they are backups of the Registry, whether full or partial I don't know, and I can delete them, manually.

My questions are;

What creates them? Win 7, Win Updates, Win 7 app installs, ...
How does one know what's in them? It's tough to restore something if you don't know what you're restoring. And how do you restore one of these?
Are there any parameters/settings that control where these backups are created and how long to keep them? I don't see them on my backup drive.
While I can access the C:\Users\Ed folder and delete them directly it appears I will need to use BartPE to delete the other copy.
Why are there two copies of these files?

CODE

Volume in drive C is Windows 7
Volume Serial Number is 1CB7-B854

Directory of C:\Documents and Settings\Ed

10/15/2011  04:30 PM         2,097,152 ntuser.dat
10/15/2011  04:30 PM           262,144 ntuser.dat.LOG1
04/28/2011  07:08 PM                 0 ntuser.dat.LOG2
06/08/2011  12:56 AM            65,536 NTUSER.DAT{1a5ec36b-916a-11e0-8394-000c761a52b9}.TM.blf
06/08/2011  12:56 AM           524,288 NTUSER.DAT{1a5ec36b-916a-11e0-8394-000c761a52b9}.TMContainer00000000000000000001.regtrans-ms
06/08/2011  12:56 AM           524,288 NTUSER.DAT{1a5ec36b-916a-11e0-8394-000c761a52b9}.TMContainer00000000000000000002.regtrans-ms
08/19/2011  03:15 PM            65,536 ntuser.dat{5c83cef5-ca6f-11e0-b341-000c761a52b9}.TM.blf
08/19/2011  03:15 PM           524,288 ntuser.dat{5c83cef5-ca6f-11e0-b341-000c761a52b9}.TMContainer00000000000000000001.regtrans-ms
08/19/2011  03:15 PM           524,288 ntuser.dat{5c83cef5-ca6f-11e0-b341-000c761a52b9}.TMContainer00000000000000000002.regtrans-ms
06/08/2011  08:10 PM            65,536 NTUSER.DAT{6a8d6267-920a-11e0-b99a-000c761a52b9}.TM.blf
06/08/2011  08:10 PM           524,288 NTUSER.DAT{6a8d6267-920a-11e0-b99a-000c761a52b9}.TMContainer00000000000000000001.regtrans-ms
06/08/2011  08:10 PM           524,288 NTUSER.DAT{6a8d6267-920a-11e0-b99a-000c761a52b9}.TMContainer00000000000000000002.regtrans-ms
04/28/2011  07:12 PM            65,536 NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf
04/28/2011  07:12 PM           524,288 NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
04/28/2011  07:12 PM           524,288 NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
06/19/2011  06:52 AM            65,536 ntuser.dat{72eb024e-99f5-11e0-81cf-000c761a52b9}.TM.blf
06/19/2011  06:52 AM           524,288 ntuser.dat{72eb024e-99f5-11e0-81cf-000c761a52b9}.TMContainer00000000000000000001.regtrans-ms

jaclaz

Oct 18 2011, 12:44 PM

They are transaction log files (for the Registry hive file NTUSER.DAT).
http://www.forensicswiki.org/wiki/Windows_...try_File_(REGF)

http://mba.shengwushibie.com/itbook/BookChapter.asp?id=28244

jaclaz

Ed_P

Oct 19 2011, 12:30 PM

Thanks for the links. But I didn't read anything about how to control the files. It's possible to control System Restore's volumes and space, something similar for these files would be helpful.

jaclaz

Oct 20 2011, 04:54 AM

It's seemingly a very unexplored field.

It is not clear (to me at least) if it is connected with the transactional log of NTFS - please read as "run fsutil.exe" :
http://technet.microsoft.com/en-us/library...3(v=ws.10).aspx
but I doubt it, it is more likely that it is part of the Kernel transatction manager - please read as "run the ktmutil.exe" :
http://technet.microsoft.com/en-us/library...661(WS.10).aspx

http://microsoft.wikia.com/wiki/Kernel_Transaction_Manager

As you can see here (TxR) is ONLY mentioned BUT NOT explained/referred to

:
http://msdn.microsoft.com/en-us/library/bb986748

Generally speaking transactional writes use the concept of quotas (or sometimas of commit date) but it is not clear at all if there are "default" settings, where they are and IF they can be changed.

http://www.codeguru.com/cpp/article.php/c18309/

The topic is assertedly "briefly touched" in a video

:
http://www.ditii.com/2007/03/02/transactio...riends-txf-txr/

jaclaz

This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.