Hard/SymLinks and Alternate Data Streams

An interesting thought just occurred to me while thinking about NTFS.

NTFS supports hard links, symbolic links, and Alternate Data Streams. Is it possible for an ADS to be a link to another file? Conversely, do the Alternate Data Streams attached to a link belong to the link itself or to the underlying filesystem data?

Andrew Lambert

Posted 2011-12-11T10:33:57.860

Reputation: 7 136

No. NTFS supports links, reparse points, and multiple data streams. – JdeBP – 2011-12-11T11:21:05.503

@JdeBP False. See here for more.

– soandos – 2011-12-11T11:37:24.977

Pointing to a MSKB article that says, as I did, that NTFS supports multiple data streams is not actually evidence of falsehood. And the KB article doesn't say anything about reparse points at all. Here's a hint: You won't find a MSKB article that contradicts what I wrote, because what I wrote is not, in fact, false. ☺ – JdeBP – 2011-12-11T11:50:33.450

NTFS has supported all three since Windows Vista. Hard links and ADSes since Windows NT 3.1. Reparse points were introduced in Windows 2000 with NTFS v3. (see here, and here)

– Andrew Lambert – 2011-12-11T11:52:45.463

2@Amazed: Symlinks are just a form of reparse points (several other forms are junctions and mount points). – user1686 – 2011-12-11T21:44:42.273

Answers

Is it possible for an ADS to be a link to another file?

AFAIK, this is not possible.

Alternate Data streams literally specify an alternate data attribute in the file's MFT entry. If two MFT entries both specify to the same cluster(s), which you cannot do.

Conversely, do the Alternate Data Streams attached to a link belong to the link itself or to the underlying filesystem data?

Alternate Data Streams are recorded in the MFT and not the link itself ( I'm assuming you mean directory entry.)

http://technet.microsoft.com/en-us/library/cc976808.aspx

surfasb

Posted 2011-12-11T10:33:57.860

Reputation: 21 453

I tried it. Here are my results:

> echo "test" > test.txt
> echo "ads of test" > test.txt:myads
> mklink /H test2.txt test.txt
  Feste Verknüpfung erstellt für test2.txt <<===>> test.txt
                    # In English: Hard link created for test2.txt
> more < test2.txt:myads
  "ads of test"
> mklink test3.txt test.txt
  symbolische Verknüpfung erstellt für test3.txt <<===>> test.txt
                    # In English: symbolic link created for test3.txt
> more < test3.txt:myads
  "ads of test"

The behavior indicates that the ADS is attached to the filesystem data and not the directory entry.

Marcel Nolte

Posted 2011-12-11T10:33:57.860

Reputation: 31