12
  • What is it?

    according to MSDN Docs, In NTFS Filesystem, there is a concept called "reparse point", and:

    When the file system opens a file with a reparse point ...

    from this line it appears that reparse point is just some metadata stored in a NTFS file object.

    but this popular answer says otherwise:

    A reparse point is what linux calls a symbolic link.

    which is the right answer?


  • Why is it named so?

    another thing that puzzles me is the naming of such a concept, I have looked up it's documenation but not seeing anything regarding the origin, do anybody have a clue for this? I would guess the name contains "parse" because it involves using a file system filter to parse the data structure, but why is it "RE-parse point", not just "parse point"?

1
  • 1
    "Look again because your data is not where you think it is." – Mokubai Feb 22 '18 at 10:32
7

A reparse point is what linux calls a symbolic link.

This is mostly, but not completely correct. Reparse points are not necessarily links; they're a "building block" upon which various link types can be implemented.

Yes, they can be used to implement symbolic links – indeed, both traditional NTFS junctions and the more recent Win10 "Unix-like" symlinks are two different kinds of reparse points.

However, they can be used to implement features which don't act like symbolic links at all. For example, Windows "volume mountpoints" (where you attach a drive to a folder, instead of to a drive letter) are also reparse points. The Wikipedia article lists a few more types – for example, deduplicated files, or "offline" files which trigger retrieval from tape backups.

Why is it named so?

It's called a "reparse point" because it interrupts the path parsing process.

When you have a path like C:\Documents and Settings\Application Data\Microsoft, you can imagine it being parsed like this:

  1. Look up the 1st component C: – it's a drive letter. Access the drive.
  2. Look up the 2nd component Documents and Settings – it's a reparse point. Read the reparse point metadata, and restart parsing from there. You'll end up at C:\Users.
  3. Look up the 3rd component Application Data – again a reparse point; read its metadata and restart path parsing from there. You'll end up at AppData\Roaming.
  4. Look...

If you have Linux, you can see a similar visualization by running namei /a/long/path/to/something, especially if the path contains symlinks.

1
  • I am wondering if you mean the Linux symbolic links used by WSL (IO_REPARSE_TAG_LX_SYMLINK) when you refer to the more recent Win10 "Unix-like" symlinks?! If you mean NTFS symbolic links, they existed ever since Windows Vista and a filter driver exists to retrofit the exact feature onto older OS versions. – 0xC0000022L Apr 3 '18 at 21:13
2

From Microsoft: Reparse Points

A file or directory can contain a reparse point, which is a collection of user-defined data. The format of this data is understood by the application which stores the data, and a file system filter, which you install to interpret the data and process the file. When an application sets a reparse point, it stores this data, plus a reparse tag, which uniquely identifies the data it is storing. When the file system opens a file with a reparse point, it attempts to find the file system filter associated with the data format identified by the reparse tag. If a file system filter is found, the filter processes the file as directed by the reparse data. If a file system filter is not found, the file open operation fails.

So the file or data stored is parsed by the filesystem, noted that it contains special data and must be reparsed by a filesystem filter in order for it to be properly resolved. Since it requires two separate parsing actions to successfully open the file it is likely that it is this that gives rise to the name "reparse point."

The data is not just parsed once. The data found in the first parse gets reparsed by some application extension in order to resolve the true meaning of the data.

That doesn't mean that a reparse point isn't a symbolic link. It could simply be a block of data that says "Look over in this file" when it has been reparsed.

1
  • @TwistyImpersonator That was what i was trying to say in my paragraph below the quote. If I can somehow phrase it better then I'm open to suggestions. – Mokubai Feb 22 '18 at 13:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.