Reparse Records: What They Are and Why They Matter for File Systems and Forensics

What reparse records are and how they work

A reparse record is a structured data block used by Windows NTFS and related file systems to store the information required to handle reparse points. Each reparse point is a filesystem object that acts as a pointer or proxy, redirecting IO to another location or handler when accessed by applications or the operating system. Reparse records contain metadata and payloads such as target paths, tags, or service-defined instructions that tell the system how to process the associated file or folder. They are central to features like symbolic links, junctions, and volume mount points, and they are frequently referenced in security, troubleshooting, and forensic investigations.

NTFS reparse points in context

In NTFS, a reparse point is marked by the reparse tag attribute in the $Extend\$Reparse alternate data stream and is paired with a reparse record stored by the filesystem. When an application opens a reparse point, the filesystem filter manager or the kernel invokes the appropriate handler instead of normal file access. Common built-in reparse tags include IO_REPARSE_TAG_SYMLINK, IO_REPARSE_TAG_MOUNT_POINT, and IO_REPARSE_TAG_NFS, while third-party filters and applications can define custom tags. The reparse record therefore carries instructions, targets, and configuration that enable advanced behaviors without storing user data directly in the main file content.

Reparse record structure at a high level

Although on-disk formats can vary by filesystem and Windows version, a reparse record typically includes a tag identifying the type of reparse point, a size field, and a buffer with target information or handler parameters. For symbolic links and directory junctions, this includes the target path and sometimes the originating path, expressed in NT-native format. For user-defined reparse handlers, the record may reference an executable or service that the system should invoke. The record is parsed and executed in kernel mode by I/O managers, making it both powerful and privileged in terms of access and impact.

Common use cases for reparse points

Reparse points are used widely across Windows for interoperability, virtualization, and developer convenience. Symbolic links and junctions provide backward compatibility and flexible directory layouts, allowing applications and scripts to reference paths that resolve correctly even when the underlying storage changes. Cloud storage sync tools, virtualization platforms, and security software also use reparse records to implement features such as transparent redirection, caching, and controlled access to network or cloud resources. Mount points let admins attach volumes at an empty folder, abstracting drive letters while preserving path-based workflows.

Reparse points in security and access control

Because reparse points can change how file system operations resolve, they affect security evaluation and access control decisions. Object managers, security descriptors, and integrity labels are applied at the reparse point itself, while the target may enforce additional checks when accessed. Developers must be careful when creating or following reparse points to avoid privilege escalation, infinite loops, or unsafe delegation. APIs such as CreateSymbolicLink require appropriate privileges, and Group Policy or filesystem settings can restrict who may create or modify reparse points on a system.

Forensic and troubleshooting considerations

From a forensic or troubleshooting perspective, reparse points and their reparse records are important artifacts for understanding file system behavior. Investigators examine reparse tags, target paths, timestamps, and associated streams to determine whether a reparse point is benign, misconfigured, or potentially malicious. Tools that enumerate reparse data must correctly parse the record structure and present it in a way that supports root cause analysis. Misconfigured junctions or unexpected symbolic links can redirect data, hide operations, or expose sensitive content, making reparse records valuable indicators in incident response.

Operational guidance and best practices

When designing systems that use reparse points, favor standard, well-documented APIs and prefer built-in types like symbolic links and junctions when they meet the requirement. Validate targets when feasible, avoid overly broad delegation of reparse creation rights, and monitor unexpected reparse points in sensitive directories. For forensic workflows, capture both the reparse metadata (tags, sizes, streams) and the resolved target to ensure accurate interpretation. Keep in mind that third‑party filters and custom handlers may extend reparse semantics, so verify behavior against documentation and observed outcomes when evaluating findings.

Notable attributes at a glance