Reparse points for files

[Stanislaw Findeisen]

I would like to create a reparse point for a file (not directory) (any).
The simpler would it be, the better.

Has anybody any idea?

Thank you.

+-------------------------------------------------------+
| When replying, please replace "my_initials" in the |
| From: address field with my initials - that is, "SF". |
+-------------------------------------------------------+

[Kellie Fitton]

Hi,

You need to implement an installable file system filter (IFS),
to be able to create/use/handle reparse points for any files
or folders on the target machine, however, you will need to
use the IFS softWare kit from microSoft.

Here is the webLink to the IFS kit:

http://www.microsoft.com/whdc/devtools/ifskit/default.mspx

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/fs/reparse_points.asp

Hope these information helps,

Kellie.

[Stanislaw Findeisen]

Really? Is there really no way to make reparse points
(FILE_ATTRIBUTE_REPARSE_POINT) for files without that kit?

In case of directories it is quite easy to make directory junction
points, which are reparse points. No kit is needed there.

Post by Kellie Fitton
Hi,
You need to implement an installable file system filter (IFS),
to be able to create/use/handle reparse points for any files
or folders on the target machine, however, you will need to
use the IFS softWare kit from microSoft.
http://www.microsoft.com/whdc/devtools/ifskit/default.mspx
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/fs/reparse_points.asp
Hope these information helps,
Kellie.

[Carl Woodward]

You can manage reparse points with FSCTL_GET_REPARSE_POINT,
FSCTL_SET_REPARSE_POINT, FSCTL_DELETE_REPARSE_POINT on files and/or folders.

Open the directory or file and send the above IOCTL codes to the file object
using DeviceIoControl.

With this method you can manage reparse points IO_REPARSE_TAG_DFS,
IO_REPARSE_FILTER_MANAGER, IO_REPARSE_TAG_HSM, IO_REPARSE_TAG_MOUNT_POINT
and IO_REPARSE_TAG_SIS. These reparse point types are provided by Microsoft.

If you need to create or distribute new reparse point tags, then yes, Kellie
is quite right, you need to use the IFS Kit.

Hope that helps,

Carly

Post by Kellie Fitton
Hi,
You need to implement an installable file system filter (IFS),
to be able to create/use/handle reparse points for any files
or folders on the target machine, however, you will need to
use the IFS softWare kit from microSoft.
http://www.microsoft.com/whdc/devtools/ifskit/default.mspx
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/fs/reparse_points.asp
Hope these information helps,
Kellie.

[Stanislaw Findeisen]

Okay, but the question is:

which of the mentioned (IO_REPARSE_TAG_DFS, IO_REPARSE_FILTER_MANAGER,
IO_REPARSE_TAG_HSM, IO_REPARSE_TAG_MOUNT_POINT and IO_REPARSE_TAG_SIS)
do work with files?

and:

how to fill DeviceIoControl's input buffer?

Post by Carl Woodward
You can manage reparse points with FSCTL_GET_REPARSE_POINT,
FSCTL_SET_REPARSE_POINT, FSCTL_DELETE_REPARSE_POINT on files and/or folders.
Open the directory or file and send the above IOCTL codes to the file object
using DeviceIoControl.
With this method you can manage reparse points IO_REPARSE_TAG_DFS,
IO_REPARSE_FILTER_MANAGER, IO_REPARSE_TAG_HSM, IO_REPARSE_TAG_MOUNT_POINT
and IO_REPARSE_TAG_SIS. These reparse point types are provided by Microsoft.
If you need to create or distribute new reparse point tags, then yes, Kellie
is quite right, you need to use the IFS Kit.
Hope that helps,
Carly

[Carl Woodward]

To be honest, I am no expert in reparse points, virtually everything I know
about them I listed in my last post!

As far as I remember IO_REPARSE_TAG_HSM is used by Window's Hierarchical
Storage Mechanism (don't know how it works though), and
IO_REPARSE_MOUNT_POINT is used to create mount points or junctions. But
these only work for directories. I did think that hard links (which do work
on files) might be implemented by reparse points but checking the
dissasembly of kernel32!CreateHardLinkW, there is no DeviceIoControl call,
just an NtSetInformationFile with information class FileInformationLinkName.
Whilst it is possible that ntoskrnl!NtSetInformation sends an IRP of
FSCTL_SET_REPARSE_POINT with IO_REPARSE_TAG_MOUNT_POINT to the file object,
I don't know. As far as the other IO_REPARSE_XXX_XXXX codes go, your guess
is as good as mine.

It struck me that you haven't said what you wanted to do with your reparse
points. What is your goal?

Carly

Post by Stanislaw Findeisen
which of the mentioned (IO_REPARSE_TAG_DFS, IO_REPARSE_FILTER_MANAGER,
IO_REPARSE_TAG_HSM, IO_REPARSE_TAG_MOUNT_POINT and IO_REPARSE_TAG_SIS) do
work with files?
how to fill DeviceIoControl's input buffer?

Post by Carl Woodward
You can manage reparse points with FSCTL_GET_REPARSE_POINT,
FSCTL_SET_REPARSE_POINT, FSCTL_DELETE_REPARSE_POINT on files and/or folders.
Open the directory or file and send the above IOCTL codes to the file
object using DeviceIoControl.
With this method you can manage reparse points IO_REPARSE_TAG_DFS,
IO_REPARSE_FILTER_MANAGER, IO_REPARSE_TAG_HSM, IO_REPARSE_TAG_MOUNT_POINT
and IO_REPARSE_TAG_SIS. These reparse point types are provided by Microsoft.
If you need to create or distribute new reparse point tags, then yes,
Kellie is quite right, you need to use the IFS Kit.
Hope that helps,
Carly

[Stanislaw Findeisen]

Post by Carl Woodward
I did think that hard links (which do work
on files) might be implemented by reparse points but checking the
dissasembly of kernel32!CreateHardLinkW, there is no DeviceIoControl call,
just an NtSetInformationFile with information class FileInformationLinkName.
Whilst it is possible that ntoskrnl!NtSetInformation sends an IRP of
FSCTL_SET_REPARSE_POINT with IO_REPARSE_TAG_MOUNT_POINT to the file object,
I don't know.

(1) Hard links are no files.

"Flags, attributes, access, and sharing that are specified in CreateFile
operate on a per-file basis."
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/fs/createhardlink.asp)

(2) FILE_ATTRIBUTE_REPARSE_POINT stands among other simple file
attributes
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/fs/getfileattributes.asp)

Post by Carl Woodward
It struck me that you haven't said what you wanted to do with your reparse
points. What is your goal?

Just to create a reparse point to help testing a backup application.

+-------------------------------------------------------+
| When replying, please replace "my_initials" in the |
| From: address field with my initials - that is, "SF". |
+-------------------------------------------------------+

[Carl Woodward]

Post by Stanislaw Findeisen

I did think that hard links (which do work on files) might be implemented
by reparse points but checking the dissasembly of
kernel32!CreateHardLinkW, there is no DeviceIoControl call, just an
NtSetInformationFile with information class FileInformationLinkName.
Whilst it is possible that ntoskrnl!NtSetInformation sends an IRP of
FSCTL_SET_REPARSE_POINT with IO_REPARSE_TAG_MOUNT_POINT to the file
object, I don't know.

(1) Hard links are no files.
"Flags, attributes, access, and sharing that are specified in CreateFile
operate on a per-file basis."
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/fs/createhardlink.asp)

No, I didn't say they were, what I was getting at was that they are a file
system object. I suspect (allthough I haven't checked) that they are just
MFT entries for which the $DATA attribute points to the same clusters as
another MFT entry.

Post by Stanislaw Findeisen
(2) FILE_ATTRIBUTE_REPARSE_POINT stands among other simple file attributes
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/fs/getfileattributes.asp)

I'm not sure what you are getting at here. The FILE_ATTRIBUTE_REPARSE_POINT
attribute cannot be directly set on a file in exactly the same way as
FILE_ATTRIBUTE_SPARSE cannot be directly set using SetFileAttributes. It can
be retrieved by GetFileAttributes granted, but in order to create a sparse
file, you have to send FSCTL_SET_SPARSE to the file object. If you have a
sparse file then the only way to clear the FILE_ATTRIBUTE_SPARSE is to
overwrite the file. The same is true of reparse points, you can set, get and
delete reparse points via DeviceIoControl calls, but that is it.

Post by Stanislaw Findeisen

It struck me that you haven't said what you wanted to do with your
reparse points. What is your goal?

Just to create a reparse point to help testing a backup application.

Have you tried using IO_REPARSE_MOUNT_POINT for directories and
IO_REPARSE_HSM on a file? Whilst not a comprehensive test, this would show
how your backup application handles reparse points.

Post by Stanislaw Findeisen
+-------------------------------------------------------+
| When replying, please replace "my_initials" in the |
| From: address field with my initials - that is, "SF". |
+-------------------------------------------------------+
--
http://www.nglogic.com
Enter through the narrow gate! (Mt 7:13-14)

[Stanislaw Findeisen]

Post by Carl Woodward

Post by Stanislaw Findeisen

I did think that hard links (which do work on files) might be implemented
by reparse points but checking the dissasembly of
kernel32!CreateHardLinkW, there is no DeviceIoControl call, just an
NtSetInformationFile with information class FileInformationLinkName.
Whilst it is possible that ntoskrnl!NtSetInformation sends an IRP of
FSCTL_SET_REPARSE_POINT with IO_REPARSE_TAG_MOUNT_POINT to the file
object, I don't know.

(1) Hard links are no files.
"Flags, attributes, access, and sharing that are specified in CreateFile
operate on a per-file basis."
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/fs/createhardlink.asp)

No, I didn't say they were, what I was getting at was that they are a file
system object. I suspect (allthough I haven't checked) that they are just
MFT entries for which the $DATA attribute points to the same clusters as
another MFT entry.

Post by Stanislaw Findeisen
(2) FILE_ATTRIBUTE_REPARSE_POINT stands among other simple file attributes
(http://msdn.microsoft.com/library/default.asp?url=/library/en-us/fileio/fs/getfileattributes.asp)

I'm not sure what you are getting at here.

I just wanted to say that it looks like FILE_ATTRIBUTE_REPARSE_POINT was
stored on a per-file basis, and thus hard links implementation wouldn't
perhaps be implemented via reparse points.

But now I realize this does not necessarily need to be true, since the
text above says about "flags and attributes that *are specified* in
CreateFile", and FILE_ATTRIBUTE_REPARSE_POINT is NOT specified there,
and one does not know if it does compose a single bitfield with other
FILE_ATTRIBUTE_* flags.

So I will have to check the hard links.

Post by Carl Woodward
Have you tried using IO_REPARSE_MOUNT_POINT for directories and
IO_REPARSE_HSM on a file? Whilst not a comprehensive test, this would show
how your backup application handles reparse points.

I managed to make directory junction points using
IO_REPARSE_TAG_MOUNT_POINT. I don't know what buffers to supply in case
of any other tag (yet).

+-------------------------------------------------------+
| When replying, please replace "my_initials" in the |
| From: address field with my initials - that is, "SF". |
+-------------------------------------------------------+