Junctions, Symlinks and Hardlinks: The Three NTFS Links That Break Your Disk Math

Three mechanisms, one idea: point somewhere else

A hardlink is a second directory entry for the same file: both names point at the same MFT record, and NTFS keeps a link counter — delete one name and the data survives until the last link goes. Hardlinks work for files only, never for folders, and never across volumes. This is the trick behind WinSxS: the component store, System32 and mountains of update backups share the same physical files, so each “copy” costs nothing extra on disk.

A junction is a reparse point on a directory — a Windows 2000 technology that redirects one folder to another on the same machine. That is how Windows builds compatibility ghosts like “Documents and Settings” pointing at C:\Users. A symbolic link is the modern, more capable version: it can target files as well as folders, use relative paths and cross volumes, but creating one needs an elevated prompt or Developer Mode.

The commands, and what they actually create

Everything is done with mklink, and the switches are the whole story. Open an elevated Command Prompt and the three forms below cover ninety percent of real cases. Verify the result with dir /AL — reparse points show up as <SYMLINK>, <SYMLINKD> or <JUNCTION>, with their targets in brackets.

• mklink /H backup.txt original.txt — a hardlink: two names, one file, zero extra bytes
• mklink /J C:\Link C:\RealFolder — a junction: old, fast, folders on the same volume only
• mklink /D C:\Link C:\RealFolder — a directory symbolic link: needs admin rights or Developer Mode
• fsutil hardlink list file.txt — shows every name the data is reachable under
• dir /AL — lists the reparse points in a folder, with type and target

Where links bite: backups, cleaners and moves

Naive space counters report hardlinked files once per link, which is how “dedupe” tools proudly announce 40 gigabytes of imaginary savings on a healthy Windows install. Some cleanup utilities chase junctions into their targets and delete real data through the back door; reputable ones skip reparse points entirely. And if you drag a folder containing a junction to another drive, Explorer may quietly replace the link with a full copy of the target — several gigabytes appearing out of nowhere.

The safe habits are simple. Use links for structure, not for storage, and document every junction you create at the root of a data drive. And never trust a folder-size number on a volume that was not scanned with hardlinks in mind — before deleting an apparent duplicate, run fsutil hardlink list, because if the data has two names, you are not looking at a copy at all.

Questions and Answers

Read next