What is a .hive file?
A registry hive is a binary file holding part of the Windows registry - the tree of settings for the system, software and users.
- Did you know
- Hives are a goldmine in forensics: files like NTUSER.DAT record what a user ran, typed and plugged in, with timestamps.
- The name hive is an in-joke from the original developers - one of them hated bees, so another named the registry’s storage after hives, cells and bins.
- Core hives like SYSTEM, SOFTWARE and SAM live in Windows\System32\config, while each user's settings sit in their own NTUSER.DAT.
- What Analyser reads
- Identify and read more security and forensics files: OpenPGP messages/keys/signatures (.pgp/.gpg/.sig - armor type, packet walk, key algorithm and user ID, secret-key warning), YARA rules, Snort/Suricata IDS rules, STIX/OpenIOC threat intel, Fiddler captures (.saz), 1Password exports (.1pux), Apple Keychain, KeePass 1.x (.kdb), Microsoft keys (.pvk) and AFF/AFF4 forensic images.
- Depth of analysis
- .hive is an identification-grade format: Analyser recognises it from its bytes and decodes the header metadata it carries, rather than opening it in a full viewer. Formats that do get a full viewer are marked "Full" on the formats page.
- Open a .hive file
- Drag a .hive file onto the Analyser home page (or tap to pick one). It is identified entirely in your browser - nothing is uploaded, there is no account, and it works offline once installed.