NTFS links are the abstraction used in the NTFS file system—the default file system for all Microsoft Windows versions belonging to the Windows NT family—to associate pathnames and certain kinds of metadata with entries in the NTFS Master File Table (MFT). NTFS broadly adopts a pattern akin to typical Unix file systems in the way it stores and references file data and metadata. Entries in the MFT correspond to both inodes (index nodes) and directory entries in a typical Unix file system.
In NTFS, an entity in the file system fundamentally exists as a record stored in the MFT of an NTFS volume, the MFT being the core database of the NTFS file system and any attributes and NTFS streams associated with said record. A link in NTFS is itself a record, stored in the MFT, which "points" to another MFT record: the target of the link. Links are the file "entries" in the volume's hierarchical file tree: an NTFS pathname such as or is a link. If the volume containing said pathnames were mapped toin a Windows system, these could be referenced asand. (Compare and contrast with typical Unix file systems, where a link is an entry in a directory—directories themselves being just a type of file stored in the file system—pointing either to another link, or to an inode.)
Types of links NTFS supports three types of links: hard links, junctions, and symbolic links.
Hard links Hard links are typical in behavior. A hard link "points" to an MFT record. That target record will be the record for a "regular" file, such as a text file or executable (assuming the NTFS volume is in a normal "healthy" state). Compare with a typical Unix file system, where a hard link points to an inode. As in such file systems, an NTFS hard link cannot point to a directory.
A typical new file creation event on an NTFS volume, then, simply involves NTFS allocating and creating one new MFT record, for storing the new file entity's file metadata—including, about any of the data clusters assigned to the file, and the file's data streams; one MFT record for a hard link which points to the first newly-created MFT record as its target; storing a reference to the hard link in a directory file; and setting the reference count of both these MFT records to. Any file name provided as part of the file creation event is stored in the hard link. An MFT record can be the target of up to 1024 hard links. Each time a new hard link is successfully created, targeting a previously extant MFT record, the target's reference count is incremented.
Symmetrically, the immediate tasks performed by NTFS in a typical file deletion event, when deleting a hard link, are as follows: removing the reference to the link from the directory file containing it (the root directory, if applicable); and decrementing by the reference counts of the MFT record targeted by the link, and, of the entry containing the hard link itself. Any MFT record which now has a refcount of is now in the "deleted" state: all its associated resources are considered "free" by NTFS, to be freely overwritten and used as needed.
Junctions
Junctions are NTFS reparse points and operate similarly to symbolic links in Unix or Linux, but are only defined for directories, and may only be absolute paths on local file systems (as opposed to remote file systems being accessed). They are created and behave in a similar way to hard links, except that if the target directory is renamed, moved, or deleted, the link will no longer be valid.
Symbolic links
Symbolic links are reparse points which operate similarly to Junction Points, or symbolic links in Unix or Linux, and accept relative paths and paths to files as well as directories. Support for directory and UNC paths were added in NTFS 3.1.
All NTFS links are intended to be transparent to applications. This means that the application accessing a link will be seamlessly redirected by the file system driver, and no special handling is needed. To users, they appear as normal directories or files. This also leads to an aliasing effect: writes to a link will pass the write to the underlying, linked file or MFT entry.
Symbolic links contain the path to the linked directory or file, and a tag identifying the driver which implements the behavior. Because they record the path, they can link to files on other volumes or even remote files. However this also means that if the referenced file is deleted or renamed, the link becomes invalid, and if the referenced file or directory is replaced with another, the link will now refer to the new file or directory.
Compared to shortcut files An NTFS symbolic link is not the same as a Windows shortcut file, which is a regular file, usually with the extension .LNK. The latter may be created on any file system (such as the earlier FAT32), may contain metadata (such as an icon to display when the shortcut is viewed in Remove links), and is not transparent to applications.
Implementations of Unix-like environments for Windows such as Cygwin and MinGW can use shortcut files to emulate symbolic links where the host operating system does not support them, if configured to do so.
Examples of use
Built-in uses Windows Component Store (WinSxS) use hard links to keep track of different versions of DLLs stored side-by-side on the hard disk drive. Basic installations of Windows Server 2008 used symlinks for \Users\All Users\ → \ProgramData\ redirection. Since Windows Vista, all versions of Windows have used a specific scheme of built-in directories and utilize hidden junctions to maintain backward compatibility with Windows XP and older. Examples of these junctions are: C:\Documents and Settings pointing to C:\Users %USERPROFILE%\Application Data pointing to %USERPROFILE%\AppData\Roaming %USERPROFILE%\My Documents\My Pictures pointing to %USERPROFILE%\Pictures
Program redirection By setting a junction point that points to a directory containing a particular version of a piece of software, it may be possible to add another version of the software and redirect the junction point to point to the version desired.
Saving storage space The contents of a junction use almost no storage space (they simply point to the original directory). If an administrator needs to have multiple points of entry to a large directory, junction points can be an effective solution. Junction points should not be confused with a copy of something as junctions simply point to the original. If directories need to be modified separately a junction cannot be used as it does not provide a distinct copy of the directory or files within.
Likewise, symbolic links and hard links are useful for merging the contents of individual files.
Circumventing predefined paths Since reinstalling Windows (or installing a new version) often requires deleting the contents of the C: drive, it is advantageous to create multiple partitions so only one partition needs to be deleted during the installation. However, some programs don't let the user choose the installation directory, or install some of their files to the C: drive even when they are installed to a different drive. By creating a junction point, the program can be tricked into installing to a different directory.
Command-line tools
Windows comes with several tools capable of creating and manipulating NTFS links. PowerShell: The New-Item cmdlet of Windows PowerShell that can create empty files, folders, junctions, and hard links. In PowerShell 5.0 and later, it can create symbolic links as well. The Get-Item and Get-ChildItem cmdlets can be used to interrogate file system objects, and if they are NTFS links, find information about them. The Remove-Item cmdlet can remove said items, although there has been a record of a bug preventing this cmdlet from working properly. Windows Command Prompt: Starting with Windows Vista and Windows Server 2008, the mklink internal command can create junctions, hard links, and symbolic links. This command is also available in ReactOS. In addition, the venerable dir command can display and filter junction points via the /aL switch. Finally, the rd command (also known as rmdir) can delete junction points. fsutil.exe: A command-line utility introduced with Windows 2000. Its hardlink sub-command can make hard links or list hard links associated with a file. Another sub-command, reparsepoint, can query or delete reparse points, the file system objects that make up junction points, hard links, and symbolic links.
In addition, the following utilities can create NTFS links, even though they don't come with Windows. : It is a component of the Resource Kit for Windows 2000 and Windows Server 2003. It can make junction points. junction: A free command-line utility from Microsoft, it can create or delete junctions. PowerShell Community Extensions (PSCX): Hosted on Microsoft PowerShell Gallery, this module adds several cmdlets for dealing with NTFS links, including: New-Hardlink, New-Junction, Get-ReparsePoint, Remove-ReparsePoint, and New-Symlink.
APIs
To create hard links, apps may use the function of Windows API. All versions of the Windows NT family can use to determine the number of hard links associated with a file. There can be up to 1024 links associated with an MFT entry. Similarly, the function can create symbolic links. Junctions are more complex to create, they require manual reparse point information filling. Junctions are defined for directories only: although the API does not fail when one creates a junction pointing to a file, the junction will not be interpreted successfully when used later.
Junctions and symbolic links pointing to directories can be removed with .
Hazards
Consistency Symbolic links and NTFS junctions can point to non-existent targets because the operating system does not continuously ensure that the target exists.
There are additional hazards in the use of NTFS directory junctions that: include links that refer to their own parent folders, such as creating hard link X:\path\to\parent which points to either X:\path\ or X:\path\to\, or specify targets by using volume drive letters, such as X:, in X:\some\path\.
Recursive structure The problem in the first case is that it creates recursive paths, which further implies infinite recursion in the directory structure. By introducing reentrancy, the presence of one or more directory junctions changes the structure of the file system from a simple proper tree into a directed graph, but recursive linking further complicates the graph-theoretical character from acyclic to cyclic. Since the same files and directories can now be encountered through multiple paths, applications which traverse reentrant or recursive structures naively may give incorrect or incoherent results, or may never terminate. Worse, if recursively deleting, such programs may attempt to delete a parent of the directory it is currently traversing.
Note that both of the conditions listed above exist in the system of hard links established on the C: drive in the default Windows setup. For example, every Windows 10 installation defines the recursive path: C:\ProgramData\ C:\ProgramData\Application Data\ C:\ProgramData\Application Data\Application Data\ C:\ProgramData\Application Data\Application Data\Application Data\ C:\ProgramData\Application Data\Application Data\Application Data\Application Data\ C:\ProgramData\Application Data\Application Data\Application Data\Application Data\Application Data\ ...