NTFS links

"Junction point" redirects here. For the video game studio, seeJunction Point Studios.

TheNTFSfile system defines various ways to redirect files and folders, e.g., to make a file point to another file or its contents without making a copy of it. The object being pointed to is called the target. Such file is called ahard or symbolic linkdepending on a way it's stored on the filesystem.

History

Symbolic links to directories or volumes, calledjunction pointsand mount points, were introduced with NTFS 3.0 that shipped with Windows 2000. From NTFS 3.1 onwards, symbolic links can be created for any kind of file system object. NTFS 3.1 was introduced together withWindows XP,but the functionality was not made available (through ntfs.sys) to user mode applications. Third-party filter drivers – such as Masatoshi Kimura's opensourcesenabledriver – could however be installed to make the feature available in user mode as well. The ntfs.sys released withWindows Vistamade the functionality available to user mode applications by default.

Since NTFS 3.1, a symbolic link can also point to a file or remoteSMBnetwork path. While NTFS junction points support only absolute paths on local drives, the NTFS symbolic links allow linking using relative paths. Additionally, the NTFS symbolic link implementation provides full support for cross-filesystem links. However, the functionality enabling cross-host symbolic links requires that the remote system also support them, which effectively limits their support to Windows Vista and later Windows operating systems.

Types

There are three classes of links:

• Hard links,which have files share the same MFT entry (inode), in the same filesystem. These behave the same as hard links in Unix or Linux, in that the directory entry references the file itself, so that renaming or removing other entries referring to the file do not affect the link.
• Junction pointsarereparse pointsand operate similarly tosymbolic linksin Unix or Linux, but are only defined for directories, and may only be absolute paths on local filesystems. They are created and behave in a similar way to hard links, except that if the target directory is renamed, moved, or deleted, the link will no longer be valid.
• Symbolic linksarereparse pointswhich operate similarly to Junction Points, or symbolic links in Unix or Linux, and accept relative paths and paths to files as well as directories. Support for directory and UNC paths were added in NTFS 3.1.

All NTFS links are designed to be transparent to applications. This means that the application accessing a link will be seamlessly redirected by the file system driver, and no special handling is needed. To users, they appear as normal directories or files. This also leads to an aliasing effect: writes to a link will pass the write to the underlying, linked file orMFTentry.

Symbolic links and junction points contain the path to the linked file, and a tag identifying the driver which implements the behaviour. Because they record the path, they can link to files on other volumes or even remote files. However this also means that if the referenced file is deleted or renamed, the link becomes invalid, and if the referenced file or directory is replaced with another, the link will now refer to the new file or directory.

Hard links create a new directory entry referring to the same MFT record, and increasing the reference count of the MFT record. This means they are restricted to files in the same filesystem, but the original file can be deleted without making the hard link invalid, since deletion reduces the reference count by one, and the file is not deleted in the MFT until the count reaches zero.

Shortcut files

An NTFS symbolic link is not the same as a Windows shortcut file, which is a regular file. The latter may be created on any filesystem (such as the earlierFAT32), may contain metadata (such as an icon to display when the shortcut is viewed in Remove links), and is not transparent to applications.

Implementations of unix-like environments for Windows such asCygwinandMingwcan use shortcut files to emulate symbolic links where the host operating system does not support them, if configured to do so.

Examples of use

Built-in uses

• Windows Component Store (WinSxS) use hard links to keep track of different versions ofDLLsstored on the hard disk drive.
• Basic installations ofWindows Server 2008used symlinks for \Users\All Users\ → \ProgramData\ redirection.
• SinceWindows Vista,all versions of Windows have used a specific scheme of built-in directories and utilize hidden junctions to maintainbackward compatibilitywith Windows XP and older. Examples of these junctions are:
  • C:\Documents and Settingspointing toC:\Users
  • %USERPROFILE%\Application Datapointing to%USERPROFILE%\AppData\Roaming
  • %USERPROFILE%\My Documents\My Picturespointing to%USERPROFILE%\Pictures

Program redirection

By setting a junction point that points to a directory containing a particular version of a piece of software, it may be possible to add another version of the software and redirect the junction point to point to the version desired.

Saving storage space

The contents of a junction use almost no storage space (they simply point to the original directory). If an administrator needs to have multiple points of entry to a large directory, junction points can be an effective solution. Junction points should not be confused with acopyof something as junctions simply point to the original. If directories need to be modified separately a junction cannot be used as it does not provide a distinct copy of the directory or files within.

Likewise, symbolic links and hard links are useful for merging the contents of individual files.

Circumventing predefined paths

Since reinstalling Windows (or installing a new version) often requires deleting the contents of theC:drive, it is advantageous to create multiplepartitionsso only one partition needs to be deleted during the installation. However, some programs don't let the user choose the installation directory, or install some of their files to theC:drive even when they are installed to a different drive. By creating a junction point, the program can be tricked into installing to a different directory.

Command-line tools

Windows comes with several tools capable of creating and manipulating NTFS links.

• PowerShell:TheNew-Itemcmdlet ofWindows PowerShellthat can create empty files, folders, junctions, and hard links.In PowerShell 5.0 and later, it can create symbolic links as well.TheGet-ItemandGet-ChildItemcmdlets can be used to interrogate file system objects, and if they are NTFS links, find information about them. TheRemove-Itemcmdlet can remove said items, although there has been a record of a bug preventing this cmdlet from working properly.
• Windows Command Prompt:Starting with Windows Vista and Windows Server 2008, themklinkinternal command can create junctions, hard links, and symbolic links.This command is also available inReactOS.In addition, the venerabledircommand can display and filter junction points via the/aLswitch.Finally, therdcommand (also known asrmdir) can delete junction points.
• fsutil.exe:A command-line utility introduced withWindows 2000.Itshardlinksub-command can make hard links or list hard links associated with a file.Another sub-command,reparsepoint,can query or deletereparse points,the file system objects that make up junction points, hard links, and symbolic links.

In addition, the following utilities can create NTFS links, even though they don't come with Windows.

• linkd:It is a component of theResource KitforWindows 2000andWindows Server 2003.It can make junction points.
• junction:A free command-line utility from Microsoft, it can create or delete junctions.
• PowerShell Community Extensions (PSCX):Hosted on Microsoft PowerShell Gallery,this module adds several cmdlets for dealing with NTFS links, including: New-Hardlink, New-Junction, Get-ReparsePoint, Remove-ReparsePoint, and New-Symlink.

APIs

To create hard links, apps may use theCreateHardLink()function ofWindows API.All versions of theWindows NT familycan useGetFileInformationByHandle()to determine the number of hard links associated with a file. There can be up to 1024 links associated with an MFT entry. Similarly, theCreateSymbolicLink()function can create symbolic links. Junctions are more complex to create. They require manualreparse pointinformation filling.A code example is found inlibuv.Junctions are defined for directories only: although the API does not fail when one creates a junction pointing to a file, the junction will not be interpreted successfully when used later.

Junctions and symbolic links, even those pointing to directories, can be removed withpNtSetInformationFile.Libuv's implementation ofunlinkon Windows demonstrates this use.Alternatively, the.NETSystem.IO.Directory.Delete()method works on them as well.

Hazards

Consistency

Symbolic links and NTFS junctions can point to non-existent targets because the operating system does not continuously ensure that the target exists.

Additional hazards lurk in the use of NTFS directory junctions that:

• include links that refer to their own parent folders, such as creating hard linkX:\path\to\parentwhich points to eitherX:\path\orX:\path\to\,or
• specify targets by using volume drive letters, such asX:,inX:\some\path\.

Recursive structure

The problem in the first case is that it creates recursive paths, which further implies infinite recursion in the directory structure. By introducing reentrancy, the presence of one or more directory junctions changes the structure of the file system from a simpleproper treeinto adirected graph,but recursive linking further complicates the graph-theoretical character fromacyclicto cyclic. Since the same files and directories can now be encountered through multiple paths, applications which traverse reentrant or recursive structures naively may give incorrect or incoherent results, or may never terminate. Worse, if recursivelydeleting,such programs may attempt to delete a parent of the directory it is currently traversing.

Note that both of the conditions listed above exist in the system of hard links established on theC:drive in the default Windows setup. For example, everyWindows 10installation defines the recursive path:

C:\ProgramData\
C:\ProgramData\Application Data\
C:\ProgramData\Application Data\Application Data\
C:\ProgramData\Application Data\Application Data\Application Data\
C:\ProgramData\Application Data\Application Data\Application Data\Application Data\
C:\ProgramData\Application Data\Application Data\Application Data\Application Data\Application Data\...

Each additional path name in this seemingly infinite set is an actual valid Windows path which refers to the same location. In practice, path names are limited by the 260-character DOS path limit (or newer 32,767 character limit), but truncation may result in incomplete or invalid path and file names. Whenever a copy of a Windows installation is archived, with directory junctions intact, to another volume on the same—or worse—anothercomputer, the archived copy may still incorporate active folders from the running installation. For example, depending on the method used for copying, a backup copy of a Windows driveX:\archive\...will include a hard link calledX:\archive\Users\USERNAME\My Documentswhich still points to folderC:\Users\USERNAME\Documents\in the current, active installation.

Cross-volume traversal

The second form of deferred target mis-referral, while conceptually simpler, can have more severe consequences. When a self-consistent volume or directory structure containing hard links which use volume drive-letter path names is copied or moved to another volume (or when the drive letter of a volume is reassigned by some other means), such links may no longer point to the corresponding targetin the copied structure.Again the results depend on the software that was used for copying; while some programs may intercede by modifying any fully subsumed hard links in the copy in order to preserve structural consistency, others may ignore, copy exactly, or even traverse into hard links, copying their contents.

The serious problems occur if hard links are copied exactly such that they become, in the new copy, cross-volume hard links which still point to original files and folders on the source volume. Unintentional cross-volume hard links, such as hard links in an "archive" folder which still point to locations on the original volume (according to drive letter), are catastrophes waiting to happen. For example, deleting what is much later presumed to be an unused archive directory on a disused backup volume may result in deleting current, active user data or system files.

A preventative measure for the drive-letter hazard is to use volume GUID path syntax,rather than paths containing volume drive letters, when specifying the target path for a directory junction. For example, consider creating an alias forX:\Some\Other\PathatX:\Some\Path\Foo:

X:\Some\Path>linkd Foo X:\Some\Other\Path

As described above, if the folder structure that contains the resulting link is moved to a disk with a drive letter other thanX:,or if the letter is changed on driveX:itself, the data content at the target location is vulnerable to accidental corruption or malicious abuse. A more resilient version of this link can partially mitigate this risk by referencing the target volume by its GUID identifier value (which can be discovered by running thefsutil volume listcommand).

X:\Some\Path>linkd Foo \\?\Volume{12345678-abcd-1234--abcdefghijkl}\Some\Other\Path

Doing so ensures that the junction will remain valid if drive letterX:is changed by any means.

As for a proactive means of avoiding directory junction disasters, the commanddir /AL /S /B "X:\Some\Path"can be used to obtain, for careful analysis prior to committing any irreversible file system alterations, a list of all hard links "below" a certain file system location. While by definition every link in the resulting list has a path name that starts withX:\Some\Path\,if any of those hard links contains a target which is not subsumed byX:\Some\Path,then the specified scope has been escaped, and the starting directory you specified is not fully-subsuming. Extra caution may be indicated in this case, since the specified directory includes files and directories which reside on other physical volumes, or whose own parent-traversal-to-root does not include the specified directory.

Limitations

Privilege requirements

The default security settings in Windows disallow non-elevated administrators and all non-administrators from creating symbolic links but not junctions. This behavior can be changed running "secpol.msc", the Local Security Policy management console (under: Security Settings\Local Policies\User Rights Assignment\Create symbolic links). It can be worked around by startingcmd.exewithRun as administratoroption or therunascommand. Starting with Windows 10 Insiders build 14972 the requirement for elevated administrator privileges was removed in Windows "Developer Mode", allowing symlinks to be created without needing to elevate the console as administrator. At the API level, aSYMBOLIC_LINK_FLAG_ALLOW_UNPRIVILEGED_CREATEflag is supplied for this purpose.

Boot time

TheWindows startup processdoes not support junction points, so it is impossible to redirect certain system folders:

• \Windows
• \Windows\System32
• \Windows\System32\Config

Other critical system boot files, such as The sleep image filehiberfil.sys,also do not support redirecetion.

System-defined locations

It is technically possible to redirect the following non-critical system folder locations:

• \Users
• \Documents and Settings
• \ProgramData
• \Program Files
• \Program Files (x86)

Doing this may lead to long-term Windows reliability or compatibility issues. Creating junctions for\Usersand\ProgramDatapointing to another drive is not recommended as it breaks updates and Windows Store Apps.

Creating junctions for \Users, \ProgramData,\Program Filesor\Program Files (x86)pointing to other locations breaks installation or upgrade of Windows.

Creating junctions for\Program Filesor\Program Files (x86)pointing to another drive breaks Windows'Component Based Servicingwhich hardlinks files from its repository \Windows\SxS to their installation directory.

Windows installer

Windows Installerdoes not fully support symbolic links. Redirecting\Windows\Installerwill cause most.msi-based Windows installers to fail with error 2755 and/or error 1632.

Symbolic link support in Windows XP

Since Windows XP uses the same NTFS format version as later releases, it's feasible to enable symbolic links support in it. For using NTFS symbolic links under Windows 2000 and XP, a third-party driver exists that does it by installing itself as a file system filter.

See also

• NTFS volume mount point
• NTFS reparse point
• Symbolic link
• File shortcut

External links

• Documentation for NTFS symbolic links on MSDN
• CreateSymbolicLink function in the Win32 API
• fsutilhardlink create- creates ahard link(Windows 2000and later)
• Microsoft Knowledge Base Article– 'How to Create and Manipulate NTFS Junction Points' (archived version)
• Junctioncommand line utility from Microsoft TechNet
• Codeproject Article– discussion on the source code of a junction point utility, aimed at programmers
• PC Mag ArticleArchived2008-12-11 at theWayback Machineabout adding any directory to the start menu (allowing a preview within the startmenu as a submenu).