What is the LOG1 file format?
A .log1 file is a write-ahead recovery log generated by Windows for a registry hive. These log files record the hive's modified ("dirty") pages so Windows can replay them and restore a consistent state after a crash or unclean shutdown. .log1 is a binary format.
Location of .log1 files
.log1 files are stored in the %SystemRoot%\System32\config folder by default and carry the hidden attribute, so in order to view them an appropriate folder view option must be activated.
.log1 as part of a larger set of files
.log1 files belong to a larger group of sidecar files paired with each registry hive. The companion log is .log2; together they implement a dual-logging scheme where Windows alternates writes between the two. The primary hive data lives in a .dat file - for example, NTUSER.DAT for the current user's hive. There is no .log3 file in this scheme.
Uses of .log1 files
.log1 files are updated whenever dirty hive pages need to be preserved before a flush to the main hive. They are essential for recovery after a power loss or unexpected shutdown, and are also helpful during system troubleshooting and program debugging. The dual .log1/.log2 alternating scheme was reworked in Windows 8.1; Windows exclusively manages these files and they should not be opened or modified by hand.
Security & safety
RISK: MEDIUMThe file itself is passive log data and not malware, but it is a PROTECTED system file: normally hidden, in use by Windows, and owned by SYSTEM/TrustedInstaller. Do NOT delete, move, or edit .LOG1/.LOG2 files - they are part of how Windows keeps the registry crash-safe, and removing them can corrupt the registry and stop Windows booting cleanly. Ignore 'cleaner'/'optimizer' guides that tell you to delete them; the OS recreates and recycles them as needed. (A file with this extension in an unexpected, user-writable location could be something else masquerading - but in the registry folders it is exactly what it claims to be.)
Format details
in a nutshellPrograms that open LOG1 files
Windows1 app
Windows (operating system) - no manual opener
Built-in There is nothing to open. Windows reads/writes and replays these logs automatically at boot; leave the files in place. Technical details
deep spec| File signature (magic bytes) | regf (hex 72 65 67 66) at offset 0 - the same base-block signature used by the hive it serves |
| Byte order | Little-endian |
| Encoding | Binary - not human-readable; requires registry-aware forensic tools to parse |
| Typical file size | A few KB to several MB, depending on how many dirty hive pages are pending flush |
| Encryption | None - protected by Windows file-system ACLs, not user-level encryption |
| Default location | %SystemRoot%\System32\config\ alongside the hive file it serves |
| Dual-logging scheme | Alternates with .LOG2 - Windows writes dirty pages to .LOG1 and .LOG2 in turn, so one log is always valid even if the other write is interrupted |
| Associated hive files | Companion to SYSTEM, SOFTWARE, SAM, SECURITY, NTUSER.DAT, UsrClass.dat and other registry hive files |
| Recovery mechanism | Dirty-page replay - on next startup after an unclean shutdown, Windows reads logged HBIN pages from .LOG1 (or .LOG2) and writes them back into the hive |
| File attribute | Hidden system file - not visible in default Explorer or folder views without enabling hidden/system file display |
| Integrity verification | Base block and log entries carry sequence numbers and checksums; torn or stale writes are detected and skipped during recovery |
| Dual-logging history | The .LOG1/.LOG2 alternating scheme was significantly reworked in Windows 8.1 (2013); earlier Windows Vista/7 used an earlier dual-log variant |
| MIME type | application/octet-stream |
| Internal structure | regf base block followed by dirty HBIN (hive bin) page records; internal format is undocumented for end users |
| Operating systems | Windows Vista, Windows 7, Windows 8/8.1, Windows 10, Windows 11 |
| Released | Windows registry hive logging; the .LOG1/.LOG2 dual-logging scheme dates to Windows Vista/7 and was reworked in Windows 8.1 (2013) |
| Latest version | Same hive log-format family (HBIN/dirty-page logging) in Windows 8.1/10/11; internal and undocumented for end users |
| Specification | learn.microsoft.com |
LOG1 conversions
Community Q&A
asked by usersNo questions yet - be the first to ask about LOG1 files.
