by Wojciech Sura

NTFS Reparse points

Linux ext2 and ext3 file systems supports a very useful feature: hardlinks and symlinks. It is quite uncommon knowledge, that for quite a very long time (as far as Windows XP) NTFS file system had both these features implemented (using special feature called NTFS reparse points, available from NTFS 3.0) and ready to use – except that there is no GUI utility to do so. Fortunately, recent Windows versions provide convenient console command: mklink.

Let’s start the console with administrative rights and make some experiments.

[shell]D:\Temporary\Hardlinks>dir /b

D:\Temporary\Hardlinks>mklink /H file2.txt file.txt
Hardlink created for file2.txt <<===>> file.txt[/shell]
What happened? Let’s think of a file in terms of its contents. The file’s contents are placed somewhere on the disk and NTFS index contains entry called file.txt pointing to these contents. Now we have created another entry – file2.txt, which points to the same contents, as file.txt. Effectively now we have one file, which resides in two places at once!

Let’s check, if it is true.
[shell]D:\Temporary\Hardlinks>dir /b

D:\Temporary\Hardlinks>type file.txt
Alice has a cat
D:\Temporary\Hardlinks>echo and dog >> file2.txt

D:\Temporary\Hardlinks>type file.txt
Alice has a cat and dog[/shell]
We modified the file2.txt, but contents of file.txt changed as well. So indeed, file.txt and file2.txt are actually the same file!

Now what happens, if we delete one of these files? Well, one entry in the NTFS index is deleted, but since there’s another one pointing to the actual data, file still exists. Only removing last existing NTFS entry for a file will result in actual deletion.

Now what’s the difference between hardlink and symbolic link? Well, the symbolic link does not point to the data, but to a specific path, so it works a little like a Windows shortcut. Let’s make one and observe, how it behaves.
[shell]D:\Temporary\Hardlinks>mklink symfile.txt file.txt
symbolic link created for symfile.txt <<===>> file.txt[/shell]
The first difference can be seen, when we simply list folder’s contents:
Volume in drive D is Dokumenty
Volume Serial Number is ECD9-AAF9

Directory of D:\Temporary\Hardlinks

2014-09-16 07:34 <DIR> .
2014-09-16 07:34 <DIR> ..
2014-09-16 07:27 16 file.txt
2014-09-16 07:29 <SYMLINK> symfile.txt [file.txt]
2 File(s) 16 bytes
2 Dir(s) 134 664 282 112 bytes free[/shell]
Windows Explorer also knows, that this is not the actual file, but merely a link to a file.


So what’s the difference between a shortcut and symlink? They are very lookalike.

Shortcut is a file, which contents describe some location on the computer and has to be interpreted by the operating system to work properly. Symlink behaves as a regular file (you may open it in Notepad etc.), but it is actually a NTFS entry pointing to another file on the file system level. This means, that if you try to examine symlink’s contents, you’ll actually see the target file’s ones.

There’s another difference between symlink and hardlink. If you create symlink to a file and then delete that file, symlink will remain intact, but will point to no longer existent object. This will cause errors, if you try to open it:
[shell]D:\Temporary\Hardlinks>del file.txt

D:\Temporary\Hardlinks>type symfile.txt
The system cannot find the file specified.[/shell]
Hardlinks can be created only withing the same NTFS volume. Symlinks, on the other hand, can be created cross-volumes.