NTFS Junctions

[mikew8760]

I have been given the task of retrieving data from my son-in-laws laptop HDD!!
He says it has reported failing sectors, and his friend has already 'had a go' at it.... I have connected it to my PC via a SATA to USB adapter and am puzzled by what I find. The HDD works fine and I can read files via Win Explorer, but many folders return an 'Access Denied' message. I guessed he had been using BitLocker ( or similar) as it's on the drive, but he assures me he's never heard of it. For curiosity I looked at the HDD via the DOS prompt, and saw that the inaccessible folders were JUNCTIONs; something I've never seen before. Wikipedia didn't really enlighten me either.
Hopefully some NTFS/HDD/USB guru may be able to shed some light and at least give some clues as to what this all means. BTW both computers run Win XP, and I can read a HDD from another laptop with the USB adapter, as I had thought the problem might be due to the missing ACL from the original host, but this seems not to be the case.
Thanks for reading the ramble this far....

 

[sminlal]

Junctions are a real pain, and Microsoft's implementation of them leave a whole lot to be desired, IMHO. You typically find them at the top level of the user profile folder. They're essentially "aliases" to specific folders in the hidden "AppData" folder tree. If you open up a Command Prompt window with the default directory pointing to the profile folder (for example: C:\users\useraname), you can see what the junctions point to by typing:

dir /al

("/al" means "show files with attribute "L" = links)

The fact that you can't access files through the junctions isn't a cause for concern, because you can access exactly the same files by going into the "appdata" folder (i.e., "c:\users\username\appdata").

 

[mikew8760]

Hi,
Many thanks for your quick response - more than I could have expected....however; I think I'm now more confused!
I have looked at the HDD again, both with Win Explorer and form the C:\ ('DOS' prompt ) and find that the directory structure is quite different in each case - which I suppose is to be expected where <JUNCTION>'s are involved. But I have been unable to find any real disk content; there should be about 6Gb lurking somwhere.
From the Command Prompt window in the root of H: (the USB assignment) there is only one junction indicated - Documents and Settings; but from Win Explorer there are a very large number of folders in a 'contorted' tree structure, and no such folder shown. Is it possible to do anything with a <junction> from the command prompt?
I suppose what I really need is a magic utility program that will untangle the pointers and create a simple directory tree and remove the junctions! (or an 'Idiots Guide' to junctions.)

One final question that has been bugging me, what on earth is the intended function of junctions??

Again, many thanks for your patience.
Mike W

 

[sminlal]

Windows Explorer shows an "idealized" view of the disk and not the true directory structure as it exists in the file system. This is most obvious in the Windows directory and in the profile directory for users. When there's a question as to what's really on the disk, I usually ignore what Windows Explorer says and use the command prompt.

Unfortunately, in their infinite wisdom, the way that Microsoft implemented junctions precludes easy access to them from conventional programs that run at the command prompt. Therefore once I use "dir /al" to figure out where the junctions really point to, I then just go and look at those directories and ignore the junctions altogether. There may be an easier way to do it, but I didn't want to spend any more time and effort on it.

The basic idea of junctions is to provide an alternate name for a directory. Microsoft included junctions when they changed the names of standard folders in the users profile so that the old names would still exist and, presumably, could be used by programs. Unfortunately the way they implemented them doesn't make it transparent and therefore it seems to me that they've caused a lot more problems than they've solved.