I have the following files in my user folder:

enter image description here

Although the files are system files, I'm constantly seeing them because I'm used to browsing Explorer with system files shown for the greater level of knowledge and control that it gives me over the OS. In the many years that I've used Windows 7 like this, I don't ever recall seeing so many system files in this folder.

I understand that ntuser.dat and ntuser.dat.LOG1 are, respectively, the HKEY_CURRENT_USER registry hive and the log for that hive, which explains the very recent timestamp of both files. However, the other four files in the folder (two .regtrans-ms files, one .blf file and one .LOG2 file) were all last modified over 6 months ago, and at least one is a 0-byte file. Despite this, trying to delete any of them brings up a dialogue claiming System has a lock on them:

enter image description here

I'd like to either remove these 4 files to get rid of the clutter in my user folder, or otherwise understand why I've never seen them before, and what purpose they're actually serving.


I took the advice of answers and comments to attempt to delete these files, but was unsuccessful; the system simply regenerated them again at next boot. At the request of Ramhound, I've created a follow-up question here.


However, the other four files in the folder (two .regtrans-ms files, one .blf file, and one .LOG2 file) were all last modified over 6 months ago.

The *.regtrans-ms contains write and read transactions changes made to NTUSER.DAT. Since those changes have already been applied to the registry these files can be safely removed.

The *.LOG2 file was created due to *.LOG1 already existing more than likely. The *.blf file contains metadata that is used to manage access to the log data contained within *.Log1. The other files are logs of changes, they can be removed, but will be created again if they are needed.

They're not backups of registry changes, actually, they're what changes to the registry are before they become changes to the registry.

As a protection against registry corruption, which used to be a fairly common, and very nasty problem in Windows, what newer versions of Windows do when a change to the registry is requested, is write the requested change to a file before doing anything.

Once Windows has determined that it's "safe" to write the change to registry, it does so, and following that, it will then verify that the change has been made, at which time it will delete the file and move onto other OS tasks. When something in this process fails, you end up amassing these files.

Once you're done analyzing them, any of these .blf or .regtrans-ms files that were created prior to the last system boot can be safely deleted. There's no way they will (or should) be written to the registry, so they're junk.

Source: NTUSER.DAT and UsrClass.dat files building up by the thousands, why and can I delete?

Eventually, these files might be created again, if everything works right, they are deleted after the changes are applied and verified. Any number of things could have caused the cleanup to fail, you likely will have to use your favorite third-party program, to kill the handle so you can delete the files.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.