Win2K’s and XP’s version of NTFS, NTFS 5, supports linking between files and directories. This can remove a lot of clutter since many Windows applications do not support relocation of their data and executables from their installation directory.

Directories are linked via Junction Points. In the figure below the directory C:\windows\Driver Cache\I386\ has specified E:\I386 as its target. An application reading or writing C:\windows\Driver Cache\I386\ would actually be accessing E:\I386.

Junction Points can be created with several utilities. Microsoft provides the Linkd program in the Win2K Resource Kit. Sysinternals provides the free command utility: Junction. I’ve been using Junction Link Magic, a graphical freeware utility that allows you to add, modify or remove junction points and list existing junction points. It’s based on the work of Mike Nordell who figured out how to use undocumented Windows API access to junction points. More information on his solution is available at The Code Project. Winbolic Link is a another graphical junction utility that provides similar functionality.

The following screen capture shows the creation of a junction point between the I386 host folder on the C: drive and its target on the E: drive.

Note that support for junctions in Explorer can be problematic. Deleting junction points behaves oddly, as well as attempting to delete folders within a directory accessed through a junction point.

NTFS junctions are implemented via reparse points, a collection of application-specific objects associated with a file or directory that create seamless extensions to file system functionality.

The reparse point is tagged with an identifier specific to the application and stored with the file or directory. A special application-specific filter (a driver of sorts) is also associated with the reparse point tag type and made known to the file system. More than one application can store a reparse point with the same file or directory, each using a different tag

When a user attempts to open a file that has been tagged with a reparse point the file system recognizes the reparse point associated with the file. It then “reparses” the open request by finding the appropriate filter associated with the application that created the reparse point and passing the reparse point data to that filter. The filter can then use the data in the reparse point to do whatever is appropriate based on the reparse point functionality intended by the application. It is a very flexible system; how exactly the reparse point works is left up to the application. The really nice thing about reparse points is that they operate transparently to the user. You simply access the reparse point and the instructions are carried out automatically.

In addition to Junction Points, Microsoft uses reparse points to implement several features including:

• Symbolic Links: A symbolic link, a.k.a. hard link, creates a new directory entry for an existing file on the same volume as itself. Hermann Schinagl provides the free NTFS Link Shellextension utility to administer Hard Links, Junctions, and Volume Mount Points.
• Volume Mount Points: A volume mount point is similar to a junction point or symbolic link but is used to create dynamic access to entire disk volumes. They will be discussed in the following Tech Log entry.

Reparse points are a nice addition to NTFS: they allow the capabilities of the file system to be enhanced without requiring any changes to the file system itself.