$REPARSE_POINT (0xC0) - Attribute - NTFS Documentation
Description: NTFS Documentation

Home | Files | Attributes | Concepts | Glossary

# Attribute - $REPARSE_POINT (0xC0)

Previous Next

## Overview

As defined in $AttrDef, this attribute has a no minimum size but a maximum of 16384 bytes.

## Layout of the Attribute (Microsoft Reparse Point)

Offset | Size | Description
--- | --- | ---
~ | ~ | Standard Attribute Header
0x00 | 4 | Reparse Type (and Flags)
0x04 | 2 | Reparse Data Length
0x06 | 2 | Padding (align to 8 bytes)
0x08 | V | Reparse Data (a)

## Layout of the Attribute (Third-Party Reparse Point)

Offset | Size | Description
--- | --- | ---
~ | ~ | Standard Attribute Header
0x00 | 4 | Reparse Type (and Flags)
0x04 | 2 | Reparse Data Length
0x06 | 2 | Padding (align to 8 bytes)
0x08 | 16 | Reparse GUID
0x18 | V | Reparse Data (a)

    (a) The structure of the Reparse Data depends on the Reparse Type. There are
        three defined Reparse Data (SymLinks, VolLinks and RSS) + the Generic Reparse.

### Symbolic Link Reparse Data

Offset | Size | Description
--- | --- | ---
0x00 | 2 | Substitute Name Offset
0x02 | 2 | Substitute Name Length
0x04 | 2 | Print Name Offset
0x08 | 2 | Print Name Length
0x10 | V | Path Buffer

### Volume Link Reparse Data

Offset | Size | Description
--- | --- | ---
0x00 | 2 | Substitute Name Offset
0x02 | 2 | Substitute Name Length
0x04 | 2 | Print Name Offset
0x08 | 2 | Print Name Length
0x10 | V | Path Buffer

### Reparse Tag Flags

    These are just the predefined reparse flags

Flag | Description
--- | ---
0x20000000 | Is alias
0x40000000 | Is high latency
0x80000000 | Is Microsoft
0x68000005 | NSS
0x68000006 | NSS recover
0x68000007 | SIS
0x68000008 | DFS
0x88000003 | Mount point
0xA8000004 | HSM
0xE8000000 | Symbolic link

## Notes

### Other Information

        The reparse point tag defines the type of the reparse point. It also
        includes several flags, which further describe the reparse point.

        The reparse point tag is an unsigned 32-bit value divided in three parts:

        1. The least significant 16 bits (i.e. bits 0 to 15) specifiy the type of
           the reparse point.
        2. The 13 bits after this (i.e. bits 16 to 28) are reserved for future use.
        3. The most significant three bits are flags describing the reparse point.
           They are defined as follows:
             bit 29: Name surrogate bit. If set, the filename is an alias for
                     another object in the system.
             bit 30: High-latecny bit. If set, accessing the first byte of data will
                     be slow. (E.g. the data is stored on a tape drive.)
             bit 31: Microsoft bit. If set, the tag is owned by Microsoft. User
                     defined tags have to use zero here.

        The system file FILE_$Extend/$Reparse contains an index named $R listing
        all reparse points on the volume. The index entry keys are as defined
        below. Note, that there is no index data associated with the index entries.

        The index entries are sorted by the index key file_id. The collation rule is
        COLLATION_NTOFS_ULONGS. FIXME: Verify whether the reparse_tag is not the
        primary key / is not a key at all. (AIA)

Copyright (C) Validate HTML Validate CSS