Question

I’ve been playing around a lot recently with manipulating reparse points programmatically, and something’s been bugging me for a little while now. Since Windows hard links aren’t reparse points like junctions or symbolic links, they can’t be accessed the same way. Creating a new one is easy enough, but I’ve yet to figure out how to read the target of one. Since extensions like Hard Link Shell Extension have property sheets displaying that information, I assume it can be done, but I’ve been unable to find any documentation on how. (I did notice that the shell extension doesn’t indicate which file is the real thing on hard links, though)

I did find this answer, which explains how to count the links to a file, but unfortunately, I’m still stuck on resolving.

Answer 1

Hardlink information are stored in $FILE_NAME attributes using POSIX name. Each of these attributes refers to a file which may refers to the original file itself. A file without any hardlink may also have a POSIX name. In other words, a hardlinked file always has multiple POSIX names. The attribute’s DirectoryFileReferenceNumber field points to an MFT entry index, which is the folder entry that contains the file.

Here are the guide to retrieve all targets of a file, whether it’s hardlinked or not.

You will need to use FSCTL_GET_NTFS_FILE_RECORD on a file to get all of its NTFS attributes and parse it to retrieve each $FILE_NAME attribute.

On each $FILE_NAME attribute, use FSCTL_GET_NTFS_FILE_RECORD on the volume where the file resides using its DirectoryFileReferenceNumber as MFT entry index to retrieve the file’s folder container information. This folder is the lowest level that contains the file. For example, if the file path is C:\MyData\Myfiles\MyDocument.txt, the lowest folder level is MyFiles. If the DirectoryFileReferenceNumber points to the root folder, which is 0x5, then you have the full path of the file. For example, C:\MyDocument.txt.

With that folder information, if it is not a root folder, you simply repeat a similar task as above which is to retrieve the folder name from the Name field of $FILE_NAME attribute. But this time, the NameType does not have to be of POSIX type and any can be used. Preferably LFN or LFN & DOS8.3 compatible type. Use its DirectoryFileReferenceNumber to get the upper folder level and repeat the task in this paragraph. When the DirectoryFileReferenceNumber points to the root folder, which is 0x5, then this repeating tasks has completed since you already have the full path of the file.

Now you have resolved one file target. The next task is to process the next $FILE_NAME attribute whose NameType is of POSIX type. Process all of them to get all file targets. Do not use this method to find out whether a file has hardlinks or not. Instead, use GetFileAttributes function since it is a lot faster.