windows-10-universalntfsinternalsreparsepoint

What are WCI reparse points (tag 0x80000018)?


The reparse point tag 0x80000018 has the "Microsoft" bit set, but is not documented on MSDN. This tag is new to Windows 10 and is defined in the SDK as IO_REPARSE_TAG_WCI. Information on this is very scarce and the most I could find on it is that it may stand for "Windows Container Image" with no explanation as to the tag's function.

Plenty of reparse point tags are mysterious, but what's special about this one is that it is used by some universal apps: when installed, %USERPROFILE%\AppData\Local\Packages\<app>\ contains a LocalCache directory which is an IO_REPARSE_TAG_WCI reparse point. Inside it is a mostly empty mirror of the user profile directory structure, consisting entirely out of these WCI reparse points.

What is the purpose behind these reparse points? Why do some universal apps use them and others don't?


Solution

  • WCI: Windows Container Isolation

    wcifs.sys is the Windows container isolation file system filter driver. For processes running in Windows containers, it provides a view of the virtual file system for that process.