What are "reparse records"?
My computer just did a chkdisk
, and when it finished processing file records, it said it had processed "44 reparse records". What exactly are they?
Solution 1:
Reparse Points are a feature of NTFS that provide a mechanism for file system filter drivers to intercept a file access request and potentially rewrite it. They provide the mechanism that powers several other NTFS features:
- Volume mount points
- Directory junctions
- Symbolic links
- Single Instance Storage
- Native Structured Storage
- Hierarchical Storage Management
Sathya's link provides a more in-depth look:
An application that wants to use the feature stores data specific to the application -- which can be any sort of data at all -- into a reparse point. The reparse point is tagged with an identifier specific to the application and stored with the file or directory. A special application-specific filter (a driver of sorts) is also associated with the reparse point tag type and made known to the file system. [...]
[...] When the file system goes to open the file, it notices the reparse point associated with the file. It then "reparses" the original request for the file, by finding the appropriate filter associated with the application that stored the reparse point, and passing the reparse point data to that filter. The filter can then use the data in the reparse point to do whatever is appropriate based on the reparse point functionality intended by the application.
The way the file system driver (FSD) figures out the file system filter (or mini filter) is by checking the ReparseTag
of the meta-data and for third-party reparse points a GUID that is part of each reparse point's meta-data. The above list of features are mostly those supplied by Microsoft as part of various Windows versions and editions (junctions introduced in Windows 2000, symbolic links in Vista/2008), but one may request to be assigned a GUID by Microsoft as pointed out in MSDN here (comment section).