If you list the directory’s contents, you’ll notice that the two files will be identical in every way, with the same creation date, permissions, and file size; only the file names differ.C:\>dir *.txt Volume in drive C is OS Volume Serial Number is 38D4-EA71 Directory of C:\ 05/12/2012 11:55 PM 8 hard.txt 05/12/2012 11:55 PM 8 test.txt 2 File(s) 16 bytes 0 Dir(s) 10,646,011,904 bytes free
Symbolic (Soft) Links and Junctions
In addition to hard links, NTFS supports another type of file-name aliasing called
For example, if the path C:\Drivers is a directory symbolic link that redirects to %SystemRoot%\System32\Drivers, an application reading C:\Drivers\Ntfs.sys actually reads %SystemRoot%\System\Drivers\Ntfs.sys. Directory symbolic links are a useful way to lift directories that are deep in a directory tree to a more convenient depth without disturbing the original tree’s structure or contents. The example just cited lifts the Drivers directory to the volume’s root directory, reducing the directory depth of Ntfs.sys from three levels to one when Ntfs.sys is accessed through the directory symbolic link. File symbolic links work much the same way—you can think of them as shortcuts, except they are actually implemented on the file system instead of being .lnk files managed by Windows Explorer. Just like hard links, symbolic links can be created with the
Because certain legacy applications might not behave securely in the presence of symbolic links, especially across different machines, the creation of symbolic links requires the SeCreateSymbolicLink privilege, which is typically granted only to administrators. The file system also has a behavior option called
By default, the Windows default symbolic link evaluation policy allows only local-to-local and local-to-remote symbolic links but not the opposite, as shown here:C:\>fsutil behavior query SymLinkEvaluation Local to local symbolic links are enabled Local to remote symbolic links are enabled. Remote to local symbolic links are disabled. Remote to Remote symbolic links are disabled.
Symbolic links are implemented using an NTFS mechanism called
The reparse tag owner can manipulate the path name specified in the file I/O operation that crosses the reparse point and let the I/O operation reissue with the altered path name. Junctions (described shortly) take this approach to redirect a directory lookup, for example.
The reparse tag owner can remove the reparse point from the file, alter the file in some way, and then reissue the file I/O operation.