\WINDOWS\system32\config\sam \WINDOWS\system32\config\security \WINDOWS\system32\config\software \WINDOWS\system32\config\system These 4 files are mapped to the corresponding HKLM hives. The ntuser.dat files are mapped to the HKCU hive but you only see your own HKCU during the current logged on session, unless you load other hives. So it depends who is logged on and how many users there are on the computer. The HKCR hive is mapped to the HKLM\SOFTWARE\Classes. The HKCU is mapped to HKEY_USERS\S-1-5-21_Classes. The HKEY_CURRENT_CONFIG is mapped to a subkey in HKLM. The HKLM\HARDWARE is only transient. So it's quite possible that different software reads the registry differently in different sessions. You see, if you export each of the major hive, and add the total size, there is a lot of overlap.