Windows File System Layout

Question 1

What is \$Recycle.Bin ?

Answer 1

The location where files deleted by the user are stored. The files are not permanently deleted, the can still be recovered and restore to their original locations.
Contain files from this particular disk only.
Configure the amount of deleted files it can store.
File deleted by the command line are not stored here.

Question 2

What is \Windows\Prefetch ?

Answer 2

Prefetcher services caches files to speed up startup time of processes / apps.

Question 3

What is \Windows\System32\config ?

Answer 3

Contains Windows registry files

Question 4

What is \Windows\System32\winevt ?

Answer 4

Contains event logs of Windows OS

Question 5

What is \PerfLogs ?

Answer 5

Contains data related to Win reliability and performance monitor. Enable user to track
performance of computer systems, applications and services.

Question 6

\What is \Program Files ?

Answer 6

Default installation folder for 64 bit applications. Write access restricted for apps.

Question 7

What is \Program Files (x86) ?

Answer 7

Default installation folder for 32 bit applications. Write access restricted for apps.

Question 8

What is \Recovery ?

Answer 8

Contains data related to Windows Recovery envirement (WinRE). Tools to help diagnose and recover from serious errors, preventing Windows from booting successfully.

Question 9

What is \System Volume Information ?

Answer 9

System restore functionality. Contains “restore points” including snapshots of important system
files. May contain deleted/modified information.

Question 10

What is \Users\Default ?

Answer 10

Serves as a template for new users folder.

Question 11

What is \Users\[username]\ ?

Answer 11

• Contacts: User contacts
• Desktop: User specific settings for desktop
• Downloads: Default location for downloaded files
• Favorites: Link to Favorites web pages bookmarked in Internet Explorer
• Documents: Location for all user documents
• Searches: User saved searches

Question 12

What is \Users\Public ?

Answer 12

Data will be shared with all users who have access to this folder.
All user can see what is in the folder (public), beware.

Question 13

What is \%user%\AppData ? (Hidden by default)

Answer 13

Local:
Browser temp files, general temp files, data related to installed programs.
Data that does not roam with the user (machine specific or too big for roaming).

LocalLow:
Similar than​ Local​ but for lower level of access (IE run in safemode)

Roaming:
Can move with user profile. Contains important folders for
Windows like Cookies, Network Shortcuts, Printer Shortcuts,
Templates, Recent, Start Menu. This folder is used by default.