How NT Protects Its Hives

Windows NT has some built-in methods for protecting system hive files. First, in the NT system32\config directory, several files have no extension (the hive files) and an equal number have the same prefix and a . log extension. Open a .log file with Notepad, and you see garbage. What is it?

This "garbage" is Windows NT's way of protecting itself from failed updates to hive files. When a hive file is being changed (for example, when you edit the Registry), the . log files ensure an unfinished write operation does not corrupt the hive. Such corruption can occur when the system fails. Here's how the fault-tolerance process works:

1. Changes to the hive are written to the hive's . log file with information about where in the hive the changes will occur, and these changes are flushed (i.e., immediately sent, not cached) to the disk.
2. The system marks the hive file to signal that the file is in transition.
3. NT enters the new data into the hive file.
4. The hive file is marked to show that the change is complete.

If the system fails between steps 2 and 4, the information in the . log file is sufficient to restore the hive file to its previous condition. Thus, the . log file isn't a complete backup­it's a recovery tool in case of accidents.

. log files aren't the only fault-tolerance measure NT provides. The preceding procedure applies to all hive files except for system, which is required to boot the computer. For system, NT uses a . log file and, each time the system is booted, also backs up system to system.alt. You can't delete, move, or rename the system or system.alt files in system32\config. If the original system hive file is unavailable or doesn't work, NT can still boot the system. The .alt file becomes the system hive file, and a backup of it becomes system.alt.

NT's automatic fault-tolerance features work well most of the time. But when these protection measures can't help, (such as after reinstallation or when you make a change to the Registry that disables your system), you must rely on your own hive backups to restore system information.