Attribute - $REPARSE_POINT (0xC0)

Overview

As defined in $AttrDef, this attribute has a no minimum size but a maximum of 16384 bytes.

Layout of the Attribute (Microsoft Reparse Point)

Layout of the Attribute (Third-Party Reparse Point)

(a) The structure of the Reparse Data depends on the Reparse Type. There are
    three defined Reparse Data (SymLinks, VolLinks and RSS) + the Generic Reparse. 

Symbolic Link Reparse Data

Volume Link Reparse Data

Reparse Tag Flags

These are just the predefined reparse flags

Notes

Other Information

    The reparse point tag defines the type of the reparse point. It also
    includes several flags, which further describe the reparse point.

    The reparse point tag is an unsigned 32-bit value divided in three parts:

    1. The least significant 16 bits (i.e. bits 0 to 15) specifiy the type of
       the reparse point.
    2. The 13 bits after this (i.e. bits 16 to 28) are reserved for future use.
    3. The most significant three bits are flags describing the reparse point.
       They are defined as follows:
         bit 29: Name surrogate bit. If set, the filename is an alias for
                 another object in the system.
         bit 30: High-latecny bit. If set, accessing the first byte of data will
                 be slow. (E.g. the data is stored on a tape drive.)
         bit 31: Microsoft bit. If set, the tag is owned by Microsoft. User
                 defined tags have to use zero here.

    The system file FILE_$Extend/$Reparse contains an index named $R listing
    all reparse points on the volume. The index entry keys are as defined
    below. Note, that there is no index data associated with the index entries.

    The index entries are sorted by the index key file_id. The collation rule is
    COLLATION_NTOFS_ULONGS. FIXME: Verify whether the reparse_tag is not the
    primary key / is not a key at all. (AIA)