NTFS "Secrets"?

Question

A few weeks ago I was reading through the Wikipedia entry on NTFS, and noticed that it was possible to use Symbolic Links amongst a number of other features that aren't readily apparent in Windows Explorer.

What other useful features exist that may not be documented on Wikipedia, and how does one get access to these features? Is there a 3rd party program, registry settings, hidden configuration windows, cli, etc. used to manipulate/create/use these features?

Update: Turning this into a community wiki.

Answer 1

Microsoft distributes at least two Sysinternals tools for this.

1. Junction lets you manipulate junction points (symbolic links).
2. Streams will show you alternate data streams. That page also shows you the :stream syntax to manipulate them from command-line.

Answer 2

Alternate Data Streams - you can use the LADS tool to enumerate them.

You can create them for example by doing:

notepad test.txt:adsname1
notepad test.txt:adsname2
notepad test.txt

All 3 will be shown in explorer as 1 file but they are all different streams attached to that same filename.

Answer 3

NTFS supports file names that the Win32 API doesn't. For example the POSIX subsystem allows the following names (from the Windows Internals book):

"TrailingDots..." 
"SameNameDifferentCase"
"samenamedifferentcase"
"TrailingSpaces    "

Apparently you can still see them all by using 'dir /x'

Its also possible to create files with really long file paths (up to 32,000 characters). You can still see them in explorer but you can't delete them easily.

Answer 4

Windows Internals by Mark Russinovich has a chapter on NTFS and what it does and doesn't support. In the fifth Edition Chapter 11 covers all the File Systems Windows NT supports, and goes into details on the internals of NTFS.

Answer 5

The Windows fsutil command exposes most of NTFS's obscure features, if I'm not mistaken. Start -> Run -> cmd.exe -> fsutil /? for more info.

Answer 6

NTFS supports “symbolic links”:

• for directories (MS term: “junctions”) in all versions of NTFS
• for files (using CreateSymbolicLink since Vista and Server 2008)

It also supports hard links for files, through the CreateHardLink function since Windows 2000.

Check this page: Hard Links and Junctions.

I've used CreateHardLink in Python scripts (through Python's ctypes module). I've even have a “deduper” script that finds duplicate files and, under some conditions, replaces them with hard links, that frees a lot of space in a typical Windows installation.

Answer 7

In 1997 O'Reilly published Windows NT File System Internals. Its old, so a lot of the information might be out of date. However, it should contain a lot of information.