Windows Structure

Windows Structure#

The default top-level layout under C:\ on a modern Windows install. The operator references this when surveying a fresh foothold to pick a staging area, to locate the OS’s own binaries and configuration, or to know where artefacts from past compromises tend to land. Per-user data lives under \Users; system data splits across \Windows, \Program Files, and \ProgramData.

Directories#

Path

Notes

\PerfLogs

System performance logs. Empty by default; populates only when Performance Monitor sessions write here.

\Program Files

64-bit applications on 64-bit Windows. On 32-bit installs, all applications.

\Program Files (x86)

64-bit installs only. WoW64 32-bit applications install here.

\ProgramData

Per-machine application state shared across users. Each application picks its own subdirectory layout.

\Users

One subdirectory per local account that has interactively logged on. Also Public (shared), Default (hidden template profile), and All Users (NTFS junction to \ProgramData).

\Users\Public

World-readable buffer accessible to every interactive user. Available as the Users share by default.

%USERPROFILE%\AppData

Per-user application data. Split into Roaming (replicates with roaming profiles), Local (machine-bound), and LocalLow (low-integrity sandboxed apps).

\Windows

The OS root. System32 is the resolver path; SysWOW64 sits beside it on 64-bit installs.

\Windows\System32

64-bit DLLs and drivers on 64-bit Windows; 32-bit on 32-bit installs. The path name is historical, not architectural.

\Windows\SysWOW64

32-bit DLLs and drivers on 64-bit Windows. Counterpart to System32 for WoW64 processes.

\Windows\System

Legacy 16-bit DLL store. Empty on modern 64-bit Windows.

\Windows\WinSxS

Component store. Carries every installed update plus the reference copies of system DLLs. Auto-scavenged from Windows 7 / Server 2008 R2 onward.

References#

Contents