I am hoping to start a discussion about the ntuser.dat file in XP. This would be located in the C:\Documents and Settings\username directory. It's a file that is supposed to maintain the registry settings. However it can grow to tremendous sizes. It continues to grow even if you do not change the registry. Being the curious type, I had to find out what is in this file. I tried opening it using FileAlyzer (from the makers of Spybot) but it would not open as it was being used by another process.

What I had to do was create a new user account for myself with admin privileges. At this point I noticed the ntuser.dat file in the new account is only a few hundred kilobytes in size. Then I began the process of deleting my original user account. During the user account deletion process, you are prompted whether to delete all of the users files or to save them. I chose to save them. The user account was gone, but the subdirectory was still present in the C:\Documents and Settings folder. Directories such as Application Data, Cookies, User Data, WINDOWS, etc were still there. But more importantly, the ntuser.dat file was still present. It had grown to over 5MB. I tried opening the file with FileAlyzer but it wouldn't open. Even though the user account was gone, the file was still locked by another process!!

To take care of this I had to restart my computer and enter "Safe Mode with Command Prompt" in the Administrator account. Using DOS commands I was able to unhide ntuser.dat and then rename it ntuser.txt. After restarting the computer I was able to open the file with FileAlyzer.

I found listings for such things as keys pressed, windows opened, window sizes, resizing of windows, scrolling positions, addresses, files opened, files saved, registry changes made, programs opened, links, etc. I am not sure if all keys pressed are retained in the file (such as typing an email or a notepad document). In FileAlyzer, strings are in a left frame and are very brief. Double-clicking on a string takes you to its location in the right frame, which shows both the hex dump and text. However, a good portion of the text was coded as if you opened an executable in Notepad. But program names and file names were easily read. I have read elsewhere that this file also stores such information as passwords, form data, etc. In essence, the file contains a complete account of what I had done on the computer since I started using Windows XP.

I'm just wondering how others feel about this type of recordkeeping being done by Microsoft without the knowledge of the user, and if anyone has any other information about how this file is used by the operating system.