NTFS Link - How to identify the target ?

Erhard Glueck 66 Reputation points
2023-01-25T14:15:48.1566667+00:00

Hello!
While exploring my powershell installations I detected the file
in
... AppData\Local\Microsoft\WindowsApps\Microsoft.PowerShell_8wekyb3d8bbwe
dir reports:
23.01.2023 16:41 0 pwsh.exe

I can invoke this file.
Only TreeSizeFree shows a arrow as hint, that it is a link.

With

fsutil reparsepoint query pwsh.exe

lists a Hex output with the information, but hardly to read.

What tool I should use to know the target of this link file?

Thank you for discussion
Erhy

Windows for business | Windows Client for IT Pros | User experience | Other
0 comments No comments
{count} vote

3 answers

Sort by: Most helpful
  1. Limitless Technology 44,766 Reputation points
    2023-01-26T16:13:29.47+00:00

    Hi. Thank you for your question and reaching out. I’d be more than happy to help you with your query.

    In Windows, you can use the command line tool "dir" or "where" to identify the target of an NTFS symbolic link.

    1. Using the "dir" command: Open the Command Prompt or PowerShell and navigate to the directory where the symlink is located. Then, use the command "dir /l" followed by the name of the symlink, for example:

    dir /l C:\path\to\symlink

    This will return information about the link, including the type of file (symbolic link), the permissions, and the target path. The target path is usually preceded by the letter "->" and is the actual file or folder the link points to.

    1. Using the "where" command: Open the Command Prompt or PowerShell and navigate to the directory where the symlink is located. Then, use the command "where" followed by the name of the symlink, for example:

    where C:\path\to\symlink

    This command will return only the target path without any additional information.

    1. Using the "fsutil" command: Open the Command Prompt or PowerShell and use the command "fsutil reparsepoint query" followed by the name of the symlink, for example:

    fsutil reparsepoint query C:\path\to\symlink

    This command will return information about the reparse point including the target path preceded by "Substitute Name"

    These commands will help you identify the target of an NTFS symbolic link in Windows.

    If the reply was helpful, please don’t forget to upvote or accept as answer, thank you.

    0 comments No comments

  2. Erhard Glueck 66 Reputation points
    2023-01-27T12:46:25.39+00:00

    Thank for Your answere!

    Sadly, your suggestion does not work with this kind of link.

    I learned from
    [https://stackoverflow.com/questions/71697488/follow-hard-links-reparsepoints-to-files-windows-terminal

    and wrote a powershell script based on the powershell function from.

    0 comments No comments

  3. Deleted

    This answer has been deleted due to a violation of our Code of Conduct. The answer was manually reported or identified through automated detection before action was taken. Please refer to our Code of Conduct for more information.


    Comments have been turned off. Learn more

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.