Windows XP Boot Hardware Registry Hive

During the Windows XP boot process, system hardware configuration details are primarily managed across two distinct registry hives: the volatile HARDWARE hive and the persistent SYSTEM hive. This article explains which hive is responsible for detecting physical devices at startup, where these hardware details are stored in memory and on disk, and how the operating system interacts with them during the boot sequence.

The Volatile HARDWARE Hive

The primary hive containing real-time system hardware configuration details during boot is HKEY_LOCAL_MACHINE\HARDWARE.

Unlike standard registry hives, the HARDWARE hive is completely volatile. It is not mapped to a permanent file on the hard drive. Instead, it is dynamically created in RAM each time Windows XP boots up. During the initial startup phase, the hardware recognizer tool—specifically NTDETECT.COM on x86-based systems—along with the operating system kernel (NTOSKRNL.EXE), probes the computer's motherboard, bus architectures, processor, BIOS, and connected components.

The collected data is compiled into the HKEY_LOCAL_MACHINE\HARDWARE tree, detailing:

  • Description: Information about the system processor, floating-point coprocessor, and system bus.
  • DeviceMap: Pointers mapping devices to ports, drives, video systems, and serial communication channels.
  • ResourceMap: Hardware resource assignments, including interrupt requests (IRQs), I/O ports, and direct memory access (DMA) channels.

Because this hive exists strictly in memory, any changes or additions vanish when the computer shuts down.

The Persistent SYSTEM Hive

While the HARDWARE hive holds the detected physical inventory, the persistent settings and driver configurations needed to initialize that hardware reside in the SYSTEM hive.

Stored physically on disk at %SystemRoot%\System32\Config\system, the SYSTEM hive is mounted under HKEY_LOCAL_MACHINE\SYSTEM. During the boot stage, the boot loader (NTLDR) reads this file to locate the CurrentControlSet (typically linked to ControlSet001). This hive contains:

  • Critical device driver configurations.
  • Hardware profiles associated with docking stations or user configurations.
  • Service start values determining which hardware services load at boot.

Summary

In Windows XP, the dynamic hardware state detected during boot is stored strictly in the volatile HARDWARE hive (HKEY_LOCAL_MACHINE\HARDWARE), while the persistent drivers, parameters, and boot-critical configurations used to activate that hardware are kept in the on-disk SYSTEM hive.