Microsoft Windows stores information contained in the
HKEY_CURRENT_USER
branch of the registry, which is often abbreviated as HKCU,
in the file NTUSER.DAT. That file is stored in the user's
profile directory, which is usually C:\Windows\Username,
where Username is the account name. The location can be checked by
issuing the command echo %USERPROFILE% from a command prompt
while logged into the account.
The file is a hidden and system file, so you would need to turn on
the display of hidden and system files in the Windows Explorer to see it,
but even then, if you are logged into the account for which you are trying
to access NTUSER.DAT it will be locked from
access. You can view the contents of the file for another account
or the contents of a backup copy of NTUSER.DAT
using the RegFileExport utility from NirSoft as explained in
Recovering information for the HKCU branch of the registry from a
backup.
