Skip to content

This is a simple tool to dump all the reparse points on an NTFS volume.

License

Notifications You must be signed in to change notification settings

tyranid/DumpReparsePoints

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

DumpReparsePoints

This is a simple tool to dump all the reparse points on an NTFS volume.

It uses the \\$Extend\\$Reparse directory which can then be queried using NtQueryDirectoryFile and the FileReparsePointInformation info class to enumerate all reparse points on the volume without actually recursively interating through all files and directories. You need to run this tool as an Administrator.

Some filter drivers will actively remove their reparse tags so it's possible that not everything will be visible but it'll identity standard tags such as MOUNT_POINT and SYMLINK.

About

This is a simple tool to dump all the reparse points on an NTFS volume.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages