Reparse Point
Definition
An NTFS attribute that redirects file access to another handler. Cloud providers use reparse tags to insert their sync drivers between the user's read and the actual content fetch.
- Filesystem
- NTFS
- Type
- File system attribute
- Common use
- Cloud sync redirection
- Forensic relevance
- Endpoint and cloud forensics
Common questions
Why do reparse points complicate endpoint forensics?+
A file that appears local may actually be a placeholder redirected through a cloud provider's sync driver, so a straightforward file copy can pull down remote content or miss data that was never fully cached locally.
Are reparse points unique to cloud storage clients?+
No, NTFS also uses them for symbolic links and mount points, cloud sync is only one common application of the same underlying mechanism.
Related terms
- Files on-Demand
- Microsoft OneDrive feature that represents cloud-only files as 0-byte placeholders on the local NTFS volume, marked with a reparse tag IO_REPARSE_TAG_CLOUD. The...
- Qcow2
- QEMU Copy-On-Write version 2. The native disk format for QEMU and KVM hypervisors, with built-in snapshot, compression and encryption support. Used widely...
- Snapshot Chain
- A parent VMDK or VHDX plus one or more child differential disks. Each child captures changes since its parent was snapshotted. Reading...
- VHDX
- Microsoft's second-generation virtual hard disk format, used by Hyper-V and recent Windows containers. Supports up to 64 TB, has block-level CRC, and...
- VMDK
- VMware Virtual Machine Disk. The on-host file that holds the guest VM's disk contents, either as a monolithic file or split into...