NTFS Hard Links

NTFS is a pretty advanced file system with a number of interesting features. In this article, we will take a look at one of such interesting features that may be helpful in various situation. In our data recovery context, hard links can be used to prevent accidental removal of important files.

The idea behind hard links is quite simple. Imagine that you need to have a certain file in two different folders. Normally you would just copy the file into the other folder and have two copies of the same. However, there two basic problems with this approach:

  • You will use twice the space required for the file itself.
  • If you change one file (add some text to your document, edit audio or video, etc.), you will need to copy it to the other folder again. Otherwise the files will not be equal anymore, one copy will become outdated.

Both problems can be solved if you create a hard link instead of copying the file.

Here is a very basic explanation of hard links. A hard link is simply a filename pointing to certain data on your hard drive disk or on other storage media. Without filenames, you would not be able to access any data. Each valid file has at least one filename, which means that each file has at least one hard link.

Most Windows users, if asked, would claim that 1 file = 1 filename, but this is not true. In NTFS, one file may have several filenames associated with it.

Consider this situation. We have a 5 Gb video called "My Wedding.mkv" in our d:\videos\ folder and want to mirror it to d:\backup\videos. Now we press the Windows logo key + R and enter:

fsutils hardlink create "d:\backup\videos\1.mkv" "d:\videos\My Wedding.mkv"

Let's open the d:\backup\videos folder in Windows Explorer. There is a new file, "1.mkv", that has exactly the same content as our "My Wedding.mkv" video.

Now we have 2 files, 5 Gb each. It's 10 Gb total, correct?

No, it's still 5 Gb, because it's only one file that appears in two locations. The second "file" does not take any additional space.

Now we "accidentally" delete the "My Wedding.mkv" file from the "d:\videos" folder. Oops, our valuable video is gone. We have to grab our file recovery program as soon as possible!

Do not worry. Just open the d:\backup\videos folder and check the "1.mkv" file. It's still there, and it's the same video that we've just deleted! We simply need to rename it to something more appropriate. We can even repeat the procedure described above and restore the file in our d:\videos\ folder by creating a hard link.

This simple example demonstrates how hard links work. If we have several hard links, we can safely delete any of them (including the original one) without deleting the file itself. Only deleting the last hard link deletes the file, and that's when we will need a tool like Advanced NTFS Recovery.

So, if you or somebody else deletes a folder with important files, having hard links of the files in a different folder will prevent you from losing them. Hard links use (almost) no space, so it's a sort of backup at no cost. However, you should take into account that it's not a true backup. If you get your file damaged using one of the links, it will become damaged for the rest of its links, as all hard links refer to the same data.

There are programs that allow creating hard links easily, without the need to enter command-line directives manually.

Articles

Create a Disk Image

You can start recovering lost or deleted files directly from the affected drive. However, the file recovery process may take some time, and it is not always possible to avoid using the drive in question...

Search By Signatures

When you delete a file, its entry in Master File Table (MFT) is marked as free and can be overwritten at any moment. Once that happens, all information about the file is lost, including its ...

Drive Letters and Mount Points

Windows traditionally uses drive letters to enable access to local or network drives. For example, the "A:" and "B:" letters used to refer to floppy drives ...

Preview Deleted Files

Advanced NTFS Recovery includes a feature that allows previewing deleted files in various popular formats. The supported formats include MS Office documents, images, videos, audio files ...

NTFS Hard Links

NTFS is a pretty advanced file system with a number of interesting features. In this article, we will take a look at one of such interesting features ...

Recover Deleted Files

The problem of lost or mistakenly deleted files is quite common. Even if you backup your most important files frequently ...

More articles...