# Check destination hardlinks outside an AzCopy transfer before replacing file content

> With hardlink preservation, Azure Files NFS uploads update existing linked paths differently from downloads to a local filesystem.

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260909-405-check-destination-hardlinks-outside-an-azcopy-transfer-before-replacing-file/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-10T00:25:11+00:00
- Modified: 2026-09-10T02:04:57+00:00
- Last reviewed by DSE: 2026-09-09
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

With hardlink preservation, Azure Files NFS uploads update existing linked paths differently from downloads to a local filesystem.

## Potentially affected

AzCopy transfers involving Azure Files NFS with hardlink-preserving source and destination filesystems.

## DSE recommendation

Include pre-existing destination links outside the selected transfer in the fidelity test.

## Article

## Source facts

With –hardlinks=preserve, uploads and service-to-service transfers into Azure Files NFS write content in place. Existing destination hardlinks outside the transfer continue to reference the updated data.

Downloads to a local filesystem use a temporary file followed by rename. Destination hardlinks outside that transfer retain the original inode and stale data instead of following the replacement. Hardlink preservation requires support on both source and destination filesystems. [Microsoft Learn](https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-files).

## Applicability

LocalFileNFS uploads and FileNFSLocal downloads require local Linux; FileNFSFileNFS service-to-service transfers can run from Windows, Linux or macOS. Identify the transfer direction, selected paths and any other destination paths linked to the same file before planning the transfer.

## DSE recommendation

DSE recommends treating out-of-scope hardlinks as part of the impact review even when their path names are not selected for copying. Decide whether they should observe new or old content and choose an approved transfer approach accordingly. Do not assume the preservation flag gives identical replacement behavior for uploads and downloads.

## Verification

Use harmless files with known link relationships at both endpoints. Replace one selected path through the approved transfer, then inspect content and file identity through every related path, including those outside the transfer. Record whether links share the new data or retain the old content. Resolve any mismatch with the application owner’s expectations before moving production data.

## Official references

[Microsoft Learn: Transfer data to or from Azure Files by using AzCopy v10](https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-files). Source retrieved September 9, 2026.

## Primary reference

- Name: Transfer data to or from Azure Files by using AzCopy v10 | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-files
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check destination hardlinks outside an AzCopy transfer before replacing file content,” DSE Security, https://update.dsesecurity.com/updates/dse-20260909-405-check-destination-hardlinks-outside-an-azcopy-transfer-before-replacing-file/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.