Disks store raw blocks of data. Users and programs, however, think in files and folders. File system management is the part of the operating system that bridges this gap. It decides how files are named, stored, found, protected and recovered.
This guide explains what a file system does, file attributes and access methods, file types, directories, how space is allocated, and the file systems you will meet on Windows, Linux and other devices.
What a file system does
A file system:
- organises data into files and directories;
- tracks where each file’s data sits on disk;
- manages free space;
- stores metadata, such as size, owner and timestamps;
- enforces permissions;
- protects consistency after crashes, often with journaling.
File attributes
Each file carries metadata. Common attributes include:
| Attribute | Meaning |
|---|---|
| Name | Human-readable name |
| Identifier | Internal number, such as an inode number on Linux |
| Type | Regular file, directory, link or device |
| Location | Where the data blocks sit |
| Size | Current size in bytes |
| Permissions | Who can read, write or execute |
| Timestamps | Created, modified and last accessed |
| Owner | User and group that own the file |
On Linux, stat filename shows most of these.
File access methods
- Sequential access: read or write from start to end, like a log file or a tape.
- Direct (random) access: jump to any block, as databases do.
- Indexed access: use an index to find records quickly, then access them directly.
File types in Unix-like systems
Linux and Unix treat almost everything as a file:
| Type | ls -l symbol | Example |
|---|---|---|
| Regular file | - | Text, images, programs |
| Directory | d | /home |
| Symbolic link | l | Shortcut to another file |
| Character device | c | /dev/tty, serial ports |
| Block device | b | /dev/sda, disks |
| Named pipe | p | Communication between processes |
| Socket | s | Local network-style communication |
Device files have a major number, which identifies the driver, and a minor number, which identifies the specific device.
Directories
Directories organise files into a tree. Linux uses one tree starting at /, with standard locations such as /etc for configuration and /var for changing data. Windows uses a tree per drive letter, such as C:\. Both support links, so one file can appear in more than one place.
How space is allocated
| Method | How it works | Pros and cons |
|---|---|---|
| Contiguous | Each file uses consecutive blocks | Fast reads, but fragmentation |
| Linked | Each block points to the next | No fragmentation, but slow random access |
| Indexed | An index block lists all data blocks | Fast random access; used by inodes |
| Extents | Ranges of consecutive blocks | Efficient for large files; used by ext4, XFS and NTFS |
Journaling file systems first record planned changes in a journal. As a result, after a crash they can recover quickly without a full disk check.
Partitions, firmware and booting
Before a disk holds a file system, it needs a partition table. Older systems use MBR, which supports up to four primary partitions and disks up to 2 TiB. Modern systems use GPT with UEFI firmware, which supports many partitions and very large disks. Read more in our guide to partitions.
Common file systems
Windows
- NTFS: the default for Windows, with permissions, journaling and encryption support.
- ReFS: designed for resilience on servers and storage pools.
- FAT32 and exFAT: simple formats for USB drives and memory cards; exFAT supports large files.
Linux
- ext4: the long-time default on many distributions; stable and well supported.
- XFS: default on RHEL and its rebuilds; strong with large files.
- Btrfs: supports snapshots, checksums and compression; default on Fedora desktop and openSUSE.
- ZFS: advanced pooling, checksums and snapshots; popular for storage servers.
macOS and mobile
- APFS: used by macOS and iOS, optimised for SSDs.
- F2FS: a flash-friendly file system used on many Android devices.
Embedded and flash
- UBIFS and JFFS2: designed for raw flash chips in routers and IoT devices.
Useful commands
df -h # free space per file system
lsblk -f # block devices and their file systems
mount # mounted file systems
du -sh /var/* # space used per directoryRelated guides
Sources
Running Linux servers in production? Our Linux server hardening & security audit checks configuration, patching, SSH and logging. You can also use our free Linux server hardening checklist, or contact us.
