What is the HVE file format?
A .hve file is a Windows Registry hive, a binary database that stores registry keys and values in Microsoft's regf format. That format has been part of Windows since Windows NT 3.1 in 1993. Every hive opens with a 4096-byte base block whose first four bytes read regf, followed by hive bins that hold the actual keys, values, and security descriptors.
Most core Windows hives, such as SYSTEM, SOFTWARE, and NTUSER.DAT, use this same format without any extension. The explicit .hve extension shows up mainly on Amcache.hve, a file in C:\Windows\appcompat\Programs that records which programs have run, along with their paths, timestamps, and often a SHA-1 hash. That makes it a favorite artifact for forensic analysts.
Security & safety
RISK: MEDIUMA .hve file itself is passive data, not an executable, so opening it in a read-only viewer is safe. The risk is operational: deleting, moving or editing an in-use registry hive can stop applications or Windows from booting. Amcache.hve is also a privacy-sensitive forensic artifact because it records program execution history. Only handle live system hives with care, and prefer read-only tools on evidence copies.
Format details
in a nutshellFULL NAMEWindows Registry Hive Fileaka Registry hive, REGF hive
DEVELOPERMicrosoftsince 1993 (Windows NT 3.1; regf format)
CATEGORYSystem Files
MIME TYPEapplication/octet-stream
TYPEBinary hierarchical database (registry hive)
This extension is also used by…
- Half-Life / GoldSrc HVE - Some game modding contexts reference .hve as a Half-Life engine data file, but this is rare and unrelated to registry hives.
- Generic hive backup files - Some backup and imaging tools save exported registry hives with a .hve extension regardless of original name.
MAGIC BYTES · FILE SIGNATURE
OFFSET
00010203
HEX
72656766
ASCII
regf
The 4096-byte base block begins with the ASCII signature 'regf' (0x72656766) at offset 0. Same signature as SYSTEM, SOFTWARE, NTUSER.DAT and other registry hives.
Programs that open HVE files
Windows5 apps
Registry Explorer (Eric Zimmerman)
Free Open the offline .hve hive with File > Live System or Load Hive, then browse keys and values, run plugins, and export findings.
AmcacheParser (Eric Zimmerman)
Free Run AmcacheParser.exe -f Amcache.hve --csv . to parse execution records into CSV for analysis.
RegRipper
Open-source Run rip.exe -r Amcache.hve -p amcache (or the amcache_tln plugin) to extract structured data during triage.
Windows Registry Editor (regedit)
Built-in In regedit, select HKEY_LOCAL_MACHINE, then File > Load Hive to mount a .hve under a temporary key for inspection.
Registry Viewer (AccessData / Exterro)
Free Open the hive read-only to browse keys, values and generate reports without altering the evidence. 
macOS1 app
hivex
Open-source Install via Homebrew and run hivexsh Amcache.hve to inspect the hive tree from Terminal. 
Linux2 apps
hivex
Open-source Run hivexsh Amcache.hve or hivexregedit --export Amcache.hve '\\' to read hive contents from the shell.
python-registry
Open-source Use the regview.py script or the library to enumerate keys and values from a .hve hive in scripts. Technical details
deep spec| Encoding | Binary regf (Windows NT Registry File) format |
| Byte order | Little-endian |
| Container | Base block (4096 bytes) followed by hive bins (hbin blocks, each a multiple of 4096 bytes) |
| Encryption | None (hive data stored in cleartext) |
| Typical size | A few hundred KB to several MB; Amcache.hve is commonly 1-15 MB |
| Structure | A 4 KB base block holds the 'regf' signature, primary/secondary sequence numbers, last-written FILETIME, format version, root cell offset, hive bins data size and a XOR-32 checksum. Data lives in hive bins ('hbin' blocks), each carrying cells that encode keys (nk), values (vk), subkey lists, and security descriptors (sk). |
| Integrity | XOR-32 checksum over the first 508 bytes of the base block; dual sequence numbers detect interrupted writes and trigger recovery from the transaction log |
| Platforms | Windows NT, Windows 2000, Windows XP, Windows Vista, Windows 7, Windows 8, Windows 10, Windows 11 |
| Notes | The most widely encountered .hve file is Amcache.hve in C:\Windows\appcompat\Programs, a forensic artifact recording recently executed programs and connected devices. Most core Windows hives (SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT) share the identical regf format but carry no extension. Hives use companion .LOG transaction logs for crash recovery. |
| Released | 1993 (Windows NT 3.1; regf format) |
| Latest version | Format version 1.5 (minor) |
| Specification | github.com |
HVE conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about HVE files.
Frequently asked questions
What is an Amcache.hve file?
Amcache.hve is the most common
.hve file. It is a Windows Registry hive stored in C:\Windows\appcompat\Programs that records which programs have run, including their full path, timestamps and often a SHA-1 hash. It is widely used in digital forensics.How do I open a .hve file?
Use a registry viewer. Eric Zimmerman's Registry Explorer opens an offline
.hve hive for browsing, or you can mount it in regedit with File > Load Hive. For automated parsing, use AmcacheParser or RegRipper.Can I open a .hve file by double-clicking it?
No. Windows does not associate
.hve with a viewer, and a hive is a binary database rather than a document. You must load it into a registry viewer or forensic parser.Is it safe to delete a .hve file?
Not if the system is using it. Deleting or moving an active registry hive can break applications or prevent Windows from booting. A stray copy left by a forensic export can be removed safely.
What is the difference between a .hve file and a .dat registry file?
Both use the same regf hive format.
NTUSER.DAT and UsrClass.dat are per-user hives with the .dat extension, while .hve most often labels Amcache.hve. The internal structure is identical.Why can't I open a .hve file on a running Windows system?
Active hives are locked by the operating system. Work on a copy captured with a forensic tool, or use
regedit's Load Hive on an offline copy.References
1msuhanov/regf - Windows registry file format specificationgithub.com
2Google Project Zero - The Windows Registry Adventure #5: The regf file formatprojectzero.google
