Windows 2000 NTFS Hard Links and Junction Points

Microsoft Windows 2000 introduced significant advancements to the NTFS file system, most notably NTFS 3.0, which added native support for file system redirections including hard links and junction points. This article explains how Windows 2000 processes these two pointer mechanisms, the underlying file system architecture that powers them, the administrative tools used to manage them, and the specific limitations and risks present in the Windows 2000 operating environment.

A hard link in Windows 2000 allows multiple directory entries to point directly to a single file on the same volume. Rather than creating a duplicate of the underlying data, the file system creates an additional entry in the Master File Table (MFT) pointing to the existing file record.

  • Volume Boundaries: Hard links can only exist on the same NTFS volume. They cannot bridge across different drive letters or target network shares.
  • File Restrictions: Hard links apply strictly to files, not directories.
  • Reference Counting: The MFT record maintains a reference count of how many links point to the file. Deleting a hard-linked file merely decrements this reference counter by one. The operating system only deletes the file’s data clusters from the disk when the reference count drops to zero and no open handles remain.
  • Management: Windows 2000 introduced the CreateHardLink Win32 API function. At the command line, Windows 2000 lacked an out-of-the-box native utility like the later fsutil or mklink commands, relying instead on POSIX subsystem tools or Resource Kit utilities to create them.

Junction Points in Windows 2000

Junction points (also known as NTFS directory junctions) allow a directory path to transparently redirect to another target directory. This functionality is built upon the Reparse Point architecture introduced with NTFS 3.0 in Windows 2000.

  • Reparse Points: When a directory is marked as a junction point, it contains a user-defined reparse tag (IO_REPARSE_TAG_MOUNT_POINT) and a data buffer storing the destination path. When the Windows 2000 I/O Manager encounters this tag during path resolution, it halts normal lookup and re-evaluates the path using the substituted target path.
  • Target Scope: Junction points can link to any directory located on a local fixed drive (for example, mapping C:\Data to D:\NewData). However, Windows 2000 does not permit junction points to target remote SMB/network shares.
  • Creation Tools: Because Windows 2000 did not feature built-in shell commands for junction management, administrators typically used the linkd.exe tool from the Windows 2000 Resource Kit or Sysinternals' junction.exe utility to create and remove them.

Limitations and Explorer Behavior

Windows 2000 implemented the underlying file system primitives for hard links and junctions, but its graphical user interface (GUI) was not fully integrated with them.

  1. Deletion Hazards in Windows Explorer: Windows 2000 Explorer was not inherently aware of junction points. If a user deleted a junction point via Windows Explorer or the standard command prompt without a specialized tool, the operating system would recursively delete the contents of the target directory rather than simply severing the junction pointer.
  2. Third-Party Tool Dependence: Native system utilities like backup agents, defragmenters, and disk usage checkers in Windows 2000 often treated junction points as regular folders, risking infinite recursion loops or duplicate backups unless configured specifically to recognize reparse tags.