SYSTEM Hive Viewer
The SYSTEM hive is where a lot of a case is decided — services and drivers, USB device history, AppCompatCache, BAM execution times, and the time zone every other timestamp depends on. This online SYSTEM hive viewer reads it in your browser, free, with nothing to install and nothing uploaded.
Open the explorer and drop the SYSTEM hive in. The current control set is resolved for you, so paths just work.
What you can read from the SYSTEM hive
- Services & drivers — config, ImagePath, and the persistence surface.
- USB history — USBSTOR device identity and connect times.
- Execution — AppCompatCache (Shimcache) and BAM last-run times.
- Time zone — the bias you need before reading any local timestamp.
Go deeper with the deep-dives on services, USBSTOR, AppCompatCache and control sets.
Frequently asked questions
- How do I open the SYSTEM hive?
- Acquire it from C:\Windows\System32\config\SYSTEM (from an image or offline disk — it is locked on a live system), then drop it into the viewer. It is parsed locally in your browser.
- What does the SYSTEM hive contain?
- Machine and hardware configuration: services and drivers, USB device history (USBSTOR), AppCompatCache (Shimcache), BAM execution times, the time zone, mounted devices, and the control sets.
- Why can't I find CurrentControlSet?
- CurrentControlSet is a runtime symbolic link that does not exist in an offline hive — you will see ControlSet001, ControlSet002, etc. The viewer resolves the current one for you via the Select key.
- Is the hive uploaded anywhere?
- No. The SYSTEM hive is parsed entirely client-side via WebAssembly and never leaves your machine.