Where does the data associated with a reparse point actually reside? I understand there’s typically a little bit of space at the end of each MFT entry (~500-800 bytes or so) where extra attributes can go. However, there’s also the special system file $Extend$Reparse. Can smaller reparse points without very much data stay resident in the MFT or does the whole structure always go to $Reparse?
Thanks,
Tony Bock
IIRC the reparse points provided for FS filters are in MFT records (special kind of attribute in the MFT record). Actually, such a MFT record is not a file, it is a placeholder which keeps the reparse point data (returned to the FS filter in the completed IRP).
$Extend$Reparse is IIRC only about the MountMgr’s database, which is used for the directory volume mount points only to implement the API of “enumerate all volume mount points hanging off this NTFS volume” (forgot the exact name).
Note that MountMgr uses MountedDevices registry to map mountdev IDs to volume GUIDs and to drive letters. As about the drive-letter-less directory mount - $Extend$Reparse is used for them (as also maybe the special MFT records).
I don’t know whether another kinds of reparse points are listed in $Extend$Reparse. If there is an API to enumerate all reparse points (not only all volume mount points) hanging off this volume - then surely yes.
–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com
http://www.storagecraft.com
“Bock, Tony” wrote in message news:xxxxx@ntfsd…
Where does the data associated with a reparse point actually reside? I understand there’s typically a little bit of space at the end of each MFT entry (~500-800 bytes or so) where extra attributes can go. However, there’s also the special system file $Extend$Reparse. Can smaller reparse points without very much data stay resident in the MFT or does the whole structure always go to $Reparse?
Thanks,
Tony Bock
The reparse point itself - tag and data buffer - is a file record
attribute in the MFT file record for the file.
The $Extend$Reparse index is an index of all files with reparse point
attributes on the volume.
You should not care about this as a consumer of reparse points.
Regards,
Sarosh.
File System Filter Lead
Microsoft Corp
This posting is provided “AS IS” with no warranties, and confers no Rights
Maxim S. Shatskih wrote:
IIRC the reparse points provided for FS filters are in MFT records
(special kind of attribute in the MFT record). Actually, such a MFT
record is not a file, it is a placeholder which keeps the reparse
point data (returned to the FS filter in the completed IRP).$Extend$Reparse is IIRC only about the MountMgr’s database, which
is used for the directory volume mount points only to implement the
API of “enumerate all volume mount points hanging off this NTFS volume”
(forgot the exact name).Note that MountMgr uses MountedDevices registry to map mountdev IDs
to volume GUIDs and to drive letters. As about the drive-letter-less
directory mount - $Extend$Reparse is used for them (as also maybe the
special MFT records).I don’t know whether another kinds of reparse points are listed in
$Extend$Reparse. If there is an API to enumerate all reparse points
(not only all volume mount points) hanging off this volume - then surely
yes.–
Maxim S. Shatskih
Windows DDK MVP
xxxxx@storagecraft.com mailto:xxxxx
> http://www.storagecraft.com
>
> “Bock, Tony” >
> wrote in message news:xxxxx@ntfsd…
>
> Where does the data associated with a reparse point actually
> reside? I understand there’s typically a little bit of space at the
> end of each MFT entry (~500-800 bytes or so) where extra attributes
> can go. However, there’s also the special system file
> $Extend$Reparse. Can smaller reparse points without very much data
> stay resident in the MFT or does the whole structure always go to
> $Reparse?
>
>
>
> Thanks,
>
>
>
> Tony Bock
></mailto:xxxxx>