Reparse Point and EFS
The IBM consultants working with me today asked me an interesting question… “Why does EFS use reparse points?”
Good question. Did some research and here’s the answer:
First problem, I didn’t completely understanding how NTFS reparse points work. I always thought a reparse point as a location pointer to somewhere else. If you use removable storage (RSS), your OS will start moving files you don’t use onto removable storage (such as a tape drive). The file is now replaced with a reparse point. When you access that reparse point, RSS will go and fetch the file for you. OK… that makes sense. But why then would EFS use reparse points?
Well… the above explanation is sorta correct. I’ve got the low-level stuff wrong. Let us first identify the key players:
1. File system add-ons: These add-ons provide additional functionality. Examples are: Removable Storage, Encrypted File System. They use reparse pointers to identify which objects on the file system should be processed by them instead of the file system.
2. Reparse Point: An attribute of a file or directory. When the file system detects an action to a file or directory with a reparse point, it will look up the associated file system add-on then trigger the add-on.
In the case of RSS, a stub file is left of the file system with a reparse point referencing the RSS add-on. When the file is access, the RSS add-on intercepts the call and performs the retrieval of the file from the removable storage device.
In the case of EFS, the encrypted file is on the file system with a reparse point referencing the EFS add-on. When the file is access, the EFS add-on intercepts the call and performs the encryption / decryption.
That was probably not the best explanation in the world. This TechNet article may do a better job.
http://www.microsoft.com/technet/prodtechnol/windows2000pro/evaluate/featfunc/bestperf.mspx