Revolvy Trivia Quizzes Revolvy Lists Revolvy Topics

NTFS reparse point

An NTFS reparse point is a type of NTFS file system object. It is available with the NTFS v3.0 found in Windows 2000 or later versions. Reparse points provide a way to extend the NTFS filesystem. A reparse point contains a reparse tag and data that are interpreted by a filesystem filter identified by the tag. Microsoft includes several default tags including NTFS symbolic links, directory junction points and volume mount points. Also, reparse points are used as placeholders for files moved by Windows 2000's Remote Storage hierarchical storage system. They also can act as hard links, but aren't limited to point to files on the same volume: they can point to directories on any local volume.[1]


In general:

  • hard link: link to a file (MFT entry). The file is still accessible as long as at least one link that points to it still exists.
  • soft link: link to its name (file path).
Soft links

Windows Vista supports a new symbolic link capability that replaces the Windows 2000 and Windows XP junction points. They are designed to aid in migration and application compatibility with UNIX operating systems. Unlike a junction point, a symbolic link can also point to a file or remote SMB network path. Additionally, the NTFS symbolic link implementation provides full support for cross-filesystem links. However, the functionality enabling cross-host symbolic links requires that the remote system also support them, which effectively limits their support to Windows Vista and later Windows operating systems.

  • NTFS symbolic link (SYMLINK): links to a local or remote, relative or absolute SMB file or path. Enabling cross-host symbolic links requires that the remote system also supports them, which effectively limits their support to Windows Vista and later Windows operating systems. Used in Windows Server 2008 for \Users\All Users\ -> \ProgramData\ redirection only (in basic installation). Symbolic links can point to non-existent targets because the operating system does not check to see if the target exists. Using mklink or mklink /D, relative symbolic links are restricted to the same volume.
  • Junction point/directory junction: since Windows 2000, links to an absolute directory (\) on a local volume. Windows Server 2008 uses this configuration for All Users folder redirects. When a junction point is created with mklink /J, deleting it using Windows Explorer will delete the targeted files immediately if using shift-delete (Windows 2000/XP/2003). The command del my_junction should not be used as it will delete all the files in the targeted directory. Deleting a junction point using Explorer is safe since Windows Vista.
Hard links
  • NTFS HARD link: since Windows NT4, links to a file on the same drive (volume). The Windows API from Windows 2000 onwards includes a CreateHardLink API function to create hard links and DeleteFile to remove them. All versions of Windows NT can use GetFileInformationByHandle to determine the number of hard links associated with a file. Hard links require an NTFS partition. Unix-like emulation or compatibility software running on Windows, such as Cygwin and Subsystem for UNIX-based Applications, allow the use of POSIX interfaces under Windows. Most modern operating systems don't allow hard links on directories to prevent endless recursion. In addition, hard links on directories would lead to inconsistencies on parent directory entries. Symbolic links and NTFS junction points are generally used instead for this purpose. Hard links can only be created to files on the same file system. If a link to a file on a different file system is needed, it may be created with a symbolic link. Hard links are created with the mklink /H command.

Hard links use the same MFT entry as the original file. Adding a hard link creates a new name attribute and increases the hard link count (for a newly created file this count equals to one). Deleting a hard link removes the appropriate name and decreases the hard link count. When the count goes to zero, the system deletes the file, freeing up its allocated disk space and releasing its MFT record. All the name attributes are independent, so deleting, moving, or renaming the file doesn't affect other hard links.

Volume mount points

Volume mount points are similar to Unix mount points, where the root of another file system is attached to a directory. In NTFS, this allows additional file systems to be mounted without requiring a separate drive letter (such as C: or D:) for each.

Once a volume has been mounted on top of an existing directory of another volume, the contents previously listed in that directory become invisible and are replaced by the content of the root directory of the mounted volume. The mounted volume could still have its own drive letter assigned separately. The file system does not allow volumes to be mutually mounted on each other. Volume mount points can be made to be either persistent (remounted automatically after system reboot) or not persistent (must be manually remounted after reboot).

Mounted volumes may use other file systems than just NTFS, possibly with their own security settings and remapping of access rights according to the remote file system policy.

Directory junctions

Directory junctions are similar to volume mount points, but reference other directories in the file system instead of other volumes. For instance, the directory C:\exampledir with a directory junction attribute that contains a link to D:\linkeddir will automatically refer to the directory D:\linkeddir when it is accessed by a user-mode application.[2] This function is conceptually similar to symbolic links to directories in Unix, except that the target in NTFS must always be another directory (typical Unix file systems allow the target of a symbolic link to be any type of file).

Directory junctions (which can be created with the command MKLINK /J junctionName targetDirectory and removed with RMDIR junctionName from a console prompt) are persistent, and resolved on the server side as they share the same security realm of the local system or domain on which the parent volume is mounted and the same security settings for its contents as the content of the target directory; however the junction itself may have distinct security settings. Unlinking a directory junction does not delete files in the target directory.

Some directory junctions are installed by default on Windows Vista, for compatibility with previous versions of Windows, such as Documents and Settings in the root directory of the system drive, which links to the Users physical directory in the root directory of the same volume. However they are hidden by default, and their security settings are set up so that the Windows Explorer will refuse to open them from within the Shell or in most applications, except for the local built-in SYSTEM user or the local Administrators group (both user accounts are used by system software installers). This additional security restriction has probably been made to avoid users of finding apparent duplicate files in the joined directories and deleting them by error, because the semantics of directory junctions is not the same as hardlinks; the reference counting is not used on the target contents and not even on the referenced container itself.

Directory junctions are soft links (they will persist even if the target directory is removed), working as a limited form of symbolic links (with an additional restriction on the location of the target), but it is an optimized version allowing faster processing of the reparse point with which they are implemented, with less overhead than the newer NTFS symbolic links, and can be resolved on the server side (when they are found in remote shared directories).

Symbolic links

Symbolic links (or soft links) were introduced in Windows Vista.[3] Symbolic links are resolved on the client side. So when a symbolic link is shared, the target is subject to the access restrictions on the client, and not the server.

Symbolic links can be created either to files (created with MKLINK symLink targetFilename) or to directories (created with MKLINK /D symLinkD targetDirectory), but (unlike Unix symbolic links) the semantic of the link must be provided with the created link. The target however need not exist or be available when the symbolic link is created: when the symbolic link will be accessed and the target will be checked for availability, NTFS will also check if it has the correct type (file or directory); it will return a not-found error if the existing target has the wrong type.

They can also reference shared directories on remote hosts or files and subdirectories within shared directories: their target is not mounted immediately at boot, but only temporarily on demand while opening them with the OpenFile or CreateFile API. Their definition is persistent on the NTFS volume where they are created (all types of symbolic links can be removed as if they were files, using DEL symLink from a command line prompt or batch).

Distributed Link Tracking (DLT)

Distributed link tracking allows applications to track files, shell shortcuts or OLE links even if they were renamed or moved to another volume within the same machine, domain or workgroup.[4] Tracking is implemented as a system service, which uses the object identifier (OID) index stored in a metafile.[5] When the application requests a track to a file or directory, the tracking service creates the OID entry, which points to the file, and file rename, copy or move operation to a NTFS v3 volume also copies the object ID. This allows the tracking service to eventually find the target file.

Single Instance Storage (SIS)

When there are several directories that have different but similar files, some of these files may have identical content. Single instance storage allows identical files to be merged to one file and create references to that merged file. SIS consists of a file system filter that manages copies, modification and merges to files; and a user space service (or groveler) that searches for files that are identical and need merging. SIS was mainly designed for remote installation servers as these may have multiple installation images that contain many identical files; SIS allows these to be consolidated but, unlike for example hard links, each file remains distinct; changes to one copy of a file will leave others unaltered. This is similar to copy-on-write, which is a technique by which memory copying is not really done until one copy is modified.[6]

Hierarchical Storage Management (HSM)

Hierarchical Storage Management is a means of transferring files that are not used for some period of time to less expensive storage media. When the file is next accessed, the reparse point on that file determines that it is needed and retrieves it from storage.

Native Structured Storage (NSS)

NSS was an ActiveX document storage technology that has since been discontinued by Microsoft. It allowed ActiveX Documents to be stored in the same multi-stream format that ActiveX uses internally. An NSS file system filter was loaded and used to process the multiple streams transparently to the application, and when the file was transferred to a non-NTFS formatted disk volume it would also transfer the multiple streams into a single stream.[7]

Known risks

The Stuxnet as part of its series of Win32 exploits uses NTFS junction points as part of its overall mode of operation.

See also
  1. "Microsoft Windows Vista Client Configuration Study Guide" Wiley Publishing, Inc. 2007 p.285
  2. Mark Russinovich. "Inside Win2K NTFS, Part 1". Microsoft Developer Network. Retrieved 2008-04-18.
  3. "Symbolic Links (Windows)". MSDN.
  6. "Single Instance Storage in Windows 2000" (PDF). Microsoft Research and Balder Technology Group.
  7. Saville, John (date unknown). What is Native Structured Storage? Windows IT Pro. Retrieved from
External links
Continue Reading...
Content from Wikipedia Licensed under CC-BY-SA.

NTFS reparse point


An NTFS reparse point is a type of NTFS file system object. It is available with the NTFS v3.0 found in Windows 2000 or later versions. Reparse points provide a way to extend the NTFS filesystem. A reparse point contains a reparse tag and data that are interpreted by a filesystem filter identified by the tag. Microsoft includes several default tags including NTFS symbolic links , directory junction points and volume mount points . Also, reparse points are used as placeholders for files moved by Windows 2000's Remote Storage hierarchical storage system. They also can act as hard links , but aren't limited to point to files on the same volume: they can point to directories on any local volume. Design In general: hard link: link to a file ( MFT entry). The file is still accessible as long as at least one link that points to it still exists. soft link: link to its name (file path). Soft links Windows Vista supports a new symbolic link capability that replaces the Windows 2000 and Windows XP junction points. They ...more...

NTFS junction point


An NTFS junction point is a symbolic link to a directory that acts as an alias of that directory. This feature of the NTFS file system offers benefits over a Windows shell shortcut (.lnk) file, such as allowing access to files within the directory via Windows Explorer , the Command Prompt , etc. Unlike NTFS symbolic links , junction points can only link to an absolute path and only to a local volume; junction points from a local volume to a remote share are unsupported. Junction points are a type of NTFS reparse point , internally represented as a mount point. They were introduced with NTFS 3.0, the default file system for Windows 2000 . The Windows 2000 and Windows 2003 Resource Kits include a program called linkd, to create junction points; Mark Russinovich of Winternals released a tool called junction which provided more complete functionality. Windows XP includes "fsutil"; Masatoshi Kimura released a filter driver for the soft/symbolic link functionality existing in Windows XP's NTFS version, to be ac ...more...



NTFS (" New Technology File System ") is a proprietary file system developed by Microsoft . Starting with Windows NT 3.1 , it is the default file system of Windows NT family. NTFS has several technical improvements over the file systems that it superseded – File Allocation Table (FAT) and High Performance File System (HPFS) – such as improved support for metadata and advanced data structures to improve performance, reliability, and disk space use. Additional extensions are a more elaborate security system based on access control lists (ACLs) and file system journaling . NTFS is supported in other desktop and server operating systems as well. Linux and BSD have a free and open-source NTFS driver, called NTFS-3G , with both read and write functionality. macOS comes with read-only support for NTFS; its disabled-by-default write support for NTFS is unstable. History In the mid-1980s, Microsoft and IBM formed a joint project to create the next generation of graphical operating system ; the result was OS/2 and HP ...more...

NTFS volume mount point


NTFS volume mount points are specialized NTFS filesystem objects which are used to mount and provide an entry point to other volumes . Mount points can be created in a directory on an NTFS file system , which gives a reference to the root directory of the mounted volume. Any empty directory can be converted to a mount point. The mounted volume is not limited to the NTFS filesystem but can be formatted with any file system supported by Microsoft Windows . Volume Mount Points are supported from NTFS 3.0, which was introduced with Windows 2000 . Though these are quite similar to regular POSIX mount points found in Unix and Unix-like systems, they only support local filesystems. On Windows Vista and later, NTFS symbolic links can be used to link local directories to remote SMB network paths. Limitations Symbolic links do not work at boot, so it's impossible to redirect e.g.: folder containing hiberfile.sys (if it's configured to be outside root directory) \Windows \Windows\System32 \Windows\Config Nevertheless, i ...more...

NTFS symbolic link


An NTFS symbolic link (symlink) is a filesystem object in the NTFS filesystem that points to another filesystem object. The object being pointed to is called the target. Symbolic links should be transparent to users; the links appear as normal files or directories, and can be acted upon by the user or application in exactly the same manner. Symbolic links to directories or volumes, called junction points and mount points , were introduced with NTFS 3.0 that shipped with Windows 2000. From NTFS 3.1 onwards, symbolic links can be created for any kind of file system object. NTFS 3.1 was introduced together with Windows XP , but the functionality was not made available (through ntfs.sys) to user mode applications. Third-party filter drivers – such as Masatoshi Kimura's opensource senable driver – could however be installed to make the feature available in user mode as well. The ntfs.sys released with Windows Vista made the functionality available to user mode applications by default. Windows symbolic links to fil ...more...

Symbolic link


In computing , a symbolic link (also symlink or soft link ) is the nickname for any file that contains a reference to another file or directory in the form of an absolute or relative path and that affects pathname resolution. Symbolic links were already present by 1978 in minicomputer operating systems from DEC and Data General's RDOS . Today they are supported by the POSIX operating system standard, most Unix-like operating systems such as FreeBSD , Linux , and Mac OS X . Limited support also exists in Windows operating systems such as Windows Vista , Windows 7 and to some degree in Windows 2000 and Windows XP in the form of shortcut files . Overview A symbolic link contains a text string that is automatically interpreted and followed by the operating system as a path to another file or directory. This other file or directory is called the "target". The symbolic link is a second file that exists independently of its target. If a symbolic link is deleted, its target remains unaffected. If a symbolic link poin ...more...

Cluster Shared Volumes


Cluster Shared Volumes (CSV) is a feature of Failover Clustering first introduced in Windows Server 2008 R2 for use with the Hyper-V role. A Cluster Shared Volume is a shared disk containing an NTFS or ReFS (ReFS: Windows Server 2012 R2 or newer) volume that is made accessible for read and write operations by all nodes within a Windows Server Failover Cluster. Benefits This enables a virtual machine (VM) complete mobility throughout the cluster as any node can access the VHD files on the shared volume. Cluster Shared Volumes simplifies storage management by allowing large numbers of VMs to be accessed off a common shared disk. CSV also increases the resiliency of the cluster by having I/O fault detection and recovery over alternate communication paths between the nodes in the cluster. While CSV is not required for Live Migration of VMs, it reduces the potential disconnection period at the end of the migration since the NTFS file system does not have to be unmounted/mounted as is the case with a traditional cl ...more...

File system


In computing , a file system or filesystem is used to control how data is stored and retrieved. Without a file system, information placed in a storage medium would be one large body of data with no way to tell where one piece of information stops and the next begins. By separating the data into pieces and giving each piece a name, the information is easily isolated and identified. Taking its name from the way paper-based information systems are named, each group of data is called a " file ". The structure and logic rules used to manage the groups of information and their names is called a "file system". There are many different kinds of file systems. Each one has different structure and logic, properties of speed, flexibility, security, size and more. Some file systems have been designed to be used for specific applications. For example, the ISO 9660 file system is designed specifically for optical discs . File systems can be used on numerous different types of storage devices that use different kinds of medi ...more...

IBM TSM HSM for Windows


" IBM Tivoli Storage Manager HSM for Windows" is an HSM product for Microsoft Windows which allows policy based archival of files out of NTFS and into IBM Tivoli Storage Manager . In its place is left a stub file with offline bit set and a matching reparse point . Access to the file is transparently provided by DMAPI drivers. The purpose of this migration is to allow rarely used or sufficiently aged files to be stored on lower cost media, while retaining transparent access as if the file were stored locally. Features In general, IBM TSM HSM for Windows is similar to many other HSM products. This section discusses the semantics of how this particular HSM implementation operates. Administrators can set up archiving policies, and HSM for Windows automatically executes the policies at predefined times, without requiring any end-user knowledge or intervention. Running in default mode HSM f/Win replaces each archived file by a stub containing a pointer to the archive in which this object is stored. Retention can be ...more...



filename list, with long filenames, foreign letters, comma, dot and space characters as they appear in a software displaying filenames A filename (also written as two words, file name ) is a name used to uniquely identify a computer file stored in a file system . Different file systems impose different restrictions on filename lengths and the allowed characters within filenames. A filename may include one or more of these components: host (or server ) – network device that contains the file device (or drive ) – hardware device or drive directory (or path ) – directory tree (e.g., /usr/bin , \TEMP , [USR.LIB.SRC] , etc.) file – base name of the file type (format or extension ) – indicates the content type of the file (e.g. .txt , .exe , .COM , etc.) version – revision or generation number of the file The components required to identify a file varies across operating systems, as does the syntax and format for a valid filename. Discussions of filenames are complicated by a lack of standardization of the term. So ...more...

Windows 2000


Windows 2000 is an operating system for use on both client and server computers. It was produced by Microsoft and released to manufacturing on December 15, 1999, and launched to retail on February 17, 2000. It is the successor to Windows NT 4.0 , and is the last version of Microsoft Windows to display the "Windows NT" designation. It is succeeded by Windows XP (released in October 2001) and Windows Server 2003 (released in April 2003). During development, Windows 2000 was known as Windows NT 5.0. Four editions of Windows 2000 were released: Professional, Server, Advanced Server, and Datacenter Server; the latter was both released to manufacturing and launched months after the other editions. While each edition of Windows 2000 was targeted at a different market, they shared a core set of features, including many system utilities such as the Microsoft Management Console and standard system administration applications. Windows 2000 introduces NTFS 3.0, Encrypting File System , as well as basic and dynamic d ...more...



OneDrive (previously SkyDrive , Windows Live SkyDrive , and Windows Live Folders ) is a file-hosting service operated by Microsoft as part of its suite of online services. It allows users to store files as well as other personal data like Windows settings or BitLocker recovery keys in the cloud . Files can be synced to a PC and accessed from a web browser or a mobile device, as well as shared publicly or with specific people. OneDrive offers 5 GB of storage space free of charge; additional storage can be added either separately or through subscriptions to other Microsoft services including Office 365 and Groove Music . History Windows Live Folders logo Logo as "SkyDrive" At its launch the service, known as Windows Live Folders at the time (with a codename of SkyDrive), was provided as a limited beta available to a few testers in the United States. On August 1, 2007, the service was expanded to a wider audience. Shortly thereafter, on August 9, 2007, the service was renamed Windows Live SkyDrive and made ava ...more...

Technical features new to Windows Vista


Windows Vista (formerly codenamed Windows "Longhorn" ) has many significant new features compared with previous Microsoft Windows versions, covering most aspects of the operating system. In addition to the new user interface, security capabilities, and developer technologies, several major components of the core operating system were redesigned, most notably the audio, print, display, and networking subsystems; while the results of this work will be visible to software developers, end-users will only see what appear to be evolutionary changes in the user interface. As part of the redesign of the networking architecture, IPv6 has been incorporated into the operating system, and a number of performance improvements have been introduced, such as TCP window scaling . Prior versions of Windows typically needed third-party wireless networking software to work properly; this is no longer the case with Windows Vista, as it includes comprehensive wireless networking support. For graphics, Windows Vista introduces a ne ...more...

Windows Vista networking technologies


In computing , Microsoft 's Windows Vista and Windows Server 2008 introduced in 2007/2008 a new networking stack named Next Generation TCP/IP stack , to improve on the previous stack in several ways. The stack includes native implementation of IPv6 , as well as a complete overhaul of IPv4. The new TCP/IP stack uses a new method to store configuration settings that enables more dynamic control and does not require a computer restart after a change in settings. The new stack, implemented as a dual-stack model, depends on a strong host-model and features an infrastructure to enable more modular components that one can dynamically insert and remove. Architecture Architecture of the Next Generation TCP/IP stack The Next Generation TCP/IP stack connects to NICs via a Network Driver Interface Specification (NDIS) driver. The network stack, implemented in tcpip.sys implements the Transport , Network and Data link layers of the TCP/IP model . The Transport layer includes implementations for TCP , UDP and unformatted ...more...

List of Microsoft Windows components


The following is a list of Microsoft Windows components . Configuration and maintenance Component Description Introduced Settings Windows 8 Control Panel Control Panel Allows users to view and change basic system settings and controls, such as adding hardware, adding and removing software , controlling user accounts , and changing accessibility options Windows 1.0 Device Manager Allows the user to display and control the hardware attached to the computer, and control what device drivers are used Windows 95 Windows Mobility Center Centralizes the most relevant information related to mobile computing Windows Vista Security and Maintenance Centralizes and reports on the status of anti-virus , Automatic Updates , Windows Firewall, and other security-related components of the operating system Windows XP SP2 Administrative Tools Microsoft Management Console Provides system administrators and advanced users with a flexible interface through which they may configure and monitor the system Windows NT 4.0 Option Pack W ...more...

IBM Tivoli Storage Manager


IBM Spectrum Protect ( Tivoli Storage Manager ) is a data protection platform that gives enterprises a single point of control and administration for backup and recovery. It is the flagship product in the IBM Spectrum Protect (Tivoli Storage Manager) family. It enables backups and recovery for virtual, physical and cloud environments of all sizes. This product is part of the IBM Spectrum Software Defined Storage suite of products and is unrelated to the Tivoli Management Framework . History TSM descended from a project done at IBM's Almaden Research Center around 1988 to back up VM/CMS systems. The first product that emerged was Workstation Data Save Facility ( WDSF ). WDSF's original purpose was to back up PC/DOS, OS/2, and AIX workstation data onto a VM/CMS (and later MVS) server. WDSF morphed into ADSTAR Distributed Storage Manager ( ADSM ) and was re-branded Tivoli Storage Manager in 1999. The TSM database (through release 5.5) was a bespoke B+ tree database; although the TSM database uses many of the sam ...more...

Features new to Windows XP


Windows XP introduced many features not found in previous versions of Windows. User interface and appearance Graphics With the introduction of Windows XP , the C++ based software-only GDI+ subsystem was introduced to replace certain GDI functions. GDI+ adds anti-aliased 2D graphics, textures, floating point coordinates, gradient shading, more complex path management, bicubic filtering, intrinsic support for modern graphics-file formats like JPEG and PNG , and support for composition of affine transformations in the 2D view pipeline. GDI+ uses ARGB values to represent color. Use of these features is apparent in Windows XP's user interface (transparent desktop icon labels, drop shadows for icon labels on the desktop, shadows under menus, translucent blue selection rectangle in Windows Explorer , sliding task panes and taskbar buttons), and several of its applications such as Microsoft Paint , Windows Picture and Fax Viewer , Photo Printing Wizard, My Pictures Slideshow screensaver, and their presence in the bas ...more...

Javascript Version
Revolvy Server