DumpReparsePoints
DumpReparsePoints copied to clipboard
This is a simple tool to dump all the reparse points on an NTFS volume.
DumpReparsePoints
This is a simple tool to dump all the reparse points on an NTFS volume.
It uses the \\$Extend\\$Reparse
directory which can then be queried using
NtQueryDirectoryFile
and the FileReparsePointInformation
info class to
enumerate all reparse points on the volume without actually recursively
interating through all files and directories. You need to run this tool
as an Administrator.
Some filter drivers will actively remove their reparse tags so it's possible
that not everything will be visible but it'll identity standard tags such as
MOUNT_POINT
and SYMLINK
.