Improvements to extended tools -> NTFS reparse points

[yossizahn]

I have 2 improvements to suggest for extended tools -> NTFS reparse points:

1. Searching for reparse points should be done in a background thread to avoid blocking the UI
2. The right-click menu "remove..." is a destructive action, the elipses usually signify that another action will be required to commit the change, so I went ahead and clicked it, but it immediately deleted the reparse point and removed it from list, I have no idea now which file that was and how much destruction I caused to the system...

[dmex]

Searching for reparse points

It doesn't search for reparse points 😉

NTFS has an undocumented index table named $Reparse:$R:$INDEX_ALLOCATION containing all reparse points across the system and what the plugin does is use the undocumented Native API to open and enumerate the table directly. This method makes it possible for administrators to view reparse points for locations with limited access improving security and completely avoids having query every last file and folder on the volume for a reparse entry improving performance.

reparse points should be done in a background thread

It'll support background threads soon™

The right-click menu "remove..." is a destructive action... so I went ahead and clicked it, but it immediately deleted the reparse point and removed it from list, I have no idea now which file that was and how much destruction I caused to the system...

Lol... I'll add prompts to those menu options. The built-in default reparse points are only used for execution aliases (e.g. wt.exe is a reparse point that can be used via the run dialog to launch windowsterminal.exe) and legacy XP library folders (C:\Documents and settings) and are otherwise not used by any application and get repaired/recreated when they're invoked and not found.

[dmex]

The delete options now have warning prompts: d89218e

[yossizahn]

It doesn't search for reparse points

Interesting, it still takes a relatively longish time. (I imagined it was going through the MFT)

[dmex]

Interesting, it still takes a relatively longish time.

Reading the array of reparse entries from \\$Extend\\$Reparse:$R:$INDEX_ALLOCATION is extremely quick:
https://github.com/winsiderss/systeminformer/blob/master/plugins/ExtendedTools/reparse.c#L123-L216

The plugin uses the reference identifier from the index to open the file to find references (and doesn't cache the result which is slow):
https://github.com/winsiderss/systeminformer/blob/master/plugins/ExtendedTools/reparse.c#L638-L729

reparse points should be done in a background thread

The latest commits added threading support 👍

[diversenok]

and doesn't cache the result which is slow

On my machine it takes a few minutes to populate the dialog with all 30k+ entries that I have from the mounted Windows Sandbox volume. I see it spends the majority of the time inside cfgmgr32.DevGetObjects calls.

[dmex]

spends the majority of the time inside cfgmgr32.DevGetObjects

Yeah the PnP query would slow down the enumeration. I've disabled those calls in the latest revision 👍