NTFS "Secrets"?

Question

A few weeks ago I was reading through the Wikipedia entry on NTFS, and noticed that it was possible to use Symbolic Links amongst a number of other features that aren't readily apparent in Windows Explorer.

What other useful features exist that may not be documented on Wikipedia, and how does one get access to these features? Is there a 3rd party program, registry settings, hidden configuration windows, cli, etc. used to manipulate/create/use these features?

Update: Turning this into a community wiki.

score 12 · Accepted Answer · answered May 01 '09 at 19:36

Microsoft distributes at least two Sysinternals tools for this.

Junction lets you manipulate junction points (symbolic links).
Streams will show you alternate data streams. That page also shows you the :stream syntax to manipulate them from command-line.

score 7 · Answer 2 · answered May 01 '09 at 19:52

Alternate Data Streams - you can use the LADS tool to enumerate them.

You can create them for example by doing:

notepad test.txt:adsname1
notepad test.txt:adsname2
notepad test.txt

All 3 will be shown in explorer as 1 file but they are all different streams attached to that same filename.

score 5 · Answer 3 · answered May 05 '09 at 02:28

NTFS supports file names that the Win32 API doesn't. For example the POSIX subsystem allows the following names (from the Windows Internals book):

"TrailingDots..." 
"SameNameDifferentCase"
"samenamedifferentcase"
"TrailingSpaces    "

Apparently you can still see them all by using 'dir /x'

Its also possible to create files with really long file paths (up to 32,000 characters). You can still see them in explorer but you can't delete them easily.

score 2 · Answer 4 · edited Aug 09 '12 at 19:14

2

Windows Internals by Mark Russinovich has a chapter on NTFS and what it does and doesn't support. In the fifth Edition Chapter 11 covers all the File Systems Windows NT supports, and goes into details on the internals of NTFS.

edited Aug 09 '12 at 19:14

Justin Dearing

1,067

answered May 31 '09 at 15:19

dmoisan

447

score 1 · Answer 5 · answered Jul 04 '10 at 23:32

1

The Windows fsutil command exposes most of NTFS's obscure features, if I'm not mistaken. Start -> Run -> cmd.exe -> fsutil /? for more info.

answered Jul 04 '10 at 23:32

score 0 · Answer 6 · answered Jul 04 '10 at 22:04

NTFS supports “symbolic links”:

for directories (MS term: “junctions”) in all versions of NTFS
for files (using CreateSymbolicLink since Vista and Server 2008)

It also supports hard links for files, through the CreateHardLink function since Windows 2000.

Check this page: Hard Links and Junctions.

I've used CreateHardLink in Python scripts (through Python's ctypes module). I've even have a “deduper” script that finds duplicate files and, under some conditions, replaces them with hard links, that frees a lot of space in a typical Windows installation.

score 0 · Answer 7 · answered Aug 09 '12 at 19:07

0

In 1997 O'Reilly published Windows NT File System Internals. Its old, so a lot of the information might be out of date. However, it should contain a lot of information.

answered Aug 09 '12 at 19:07

Justin Dearing

1,067

NTFS "Secrets"?

7 Answers7