Fig 1Hive plus logHover to scrub · arrows steppython-registry · NTUSER.DAT only
Pending entries in ntuser.dat.LOG1: the two flag halvesNTUSER.DAT: the hive as it sat on diskWindows writes registry changes to the transaction log first and merges them into the hive later. The two RecentDocs entries whose names decode to the flag were still in ntuser.dat.LOG1, so a parser that reads NTUSER.DAT alone returned a clean 101 MB dump with no flag in it. Replaying the logs, as Registry Explorer, yarp and regipy do, brings them in.