Files on-Demand
Definition
Microsoft OneDrive feature that represents cloud-only files as 0-byte placeholders on the local NTFS volume, marked with a reparse tag IO_REPARSE_TAG_CLOUD. The content downloads transparently when the user opens the file.
- Vendor feature
- Microsoft OneDrive
- Local representation
- 0-byte placeholder files
- Filesystem
- NTFS
- Marker
- Reparse tag IO_REPARSE_TAG_CLOUD
Common questions
Why does Files On-Demand matter for an examiner imaging a disk?+
A placeholder file shows a filename, size, and timestamps on the local disk even though the actual content sits in the cloud, so an examiner must recognise the reparse tag and separately determine whether the real content is retrievable rather than assuming the local image holds the file's content.
How can an examiner tell a placeholder apart from a fully downloaded local file?+
The reparse point attribute IO_REPARSE_TAG_CLOUD marks it as cloud-only, and the on-disk allocation is effectively empty despite the file showing its true reported size, which standard file listing tools can reveal.
Related terms
- Qcow2
- QEMU Copy-On-Write version 2. The native disk format for QEMU and KVM hypervisors, with built-in snapshot, compression and encryption support. Used widely...
- Reparse Point
- An NTFS attribute that redirects file access to another handler. Cloud providers use reparse tags to insert their sync drivers between the...
- Snapshot Chain
- A parent VMDK or VHDX plus one or more child differential disks. Each child captures changes since its parent was snapshotted. Reading...
- VHDX
- Microsoft's second-generation virtual hard disk format, used by Hyper-V and recent Windows containers. Supports up to 64 TB, has block-level CRC, and...
- VMDK
- VMware Virtual Machine Disk. The on-host file that holds the guest VM's disk contents, either as a monolithic file or split into...