What is file system?

Any computer file is stored on some kind of storage: hard disk, CD, DVD, flash memory and so on. These storages have specific, model-dependent capacity to store data. From the software point of view (including operating system) each storage is linear space to read or both read and write the digital information. Each byte of the information on a storage has its own specific offset from storage start (the address) and could be referenced by this address. You may imagine storage as grid with set of numbered cells (each cell - the single byte). Any file saved to storage takes a number of these cells.

Historically, computer storages like hard disk, CD, DVD or flash memory use pair of sector and in-sector offset to reference any byte of information on storage. The sector is the group of bytes (usually 512 bytes) that is minimum addressable unit of the physical storage. For example, byte 1030 on hard disk will be referenced as sector #3 and offset in sector 16 bytes ([sector]+[sector]+[16 bytes]). This schema is used to optimize storage addressing and use smaller number to reference any portion of information on the storage.

To omit second part of the address (the in-sector offset), files on storage are usually stored from the sector start and take all whole sectors (e.g.: 10 byte file takes a whole sector, 512 byte files also takes one sector, 514 byte file will take two whole sectors and so on).

Each file will be stored to 'unused' sectors and could be read then by known position and size. However, how do we know what sectors are used or unused? Where are file size and position stored? Where is file name? This answers give us the file system.

File system - is just a kind of structured data representation on a storage and set of metadata to describe the stored data. Unlike plain storage, file system could be located on disk partition - the isolated segment of storage. Usually it operates blocks, not sectors. The file system blocks are groups of sectors aimed at storage addressing optimization. Modern file systems generally use block sizes from 1 up to 128 sectors (512-65536 bytes). The files are usually stored from start of block and take entire blocks.

Many write/delete operations to file system could cause file system fragmentation: the files could not be stored as whole fragments anymore and are divided to fragments. Here is an example of framentation: imagine a storage entirely taken by files with size about 4 blocks (e.g. pictures collection). User wants to store a file that would take 8 blocks and therefore deletes the first and the last file. By doing this he releases 8 blocks, however the first segment is near to storage start, and the second near to storage end. In this case 8 block file will be split into two parts (4 blocks for each part) and will take free space 'holes'. The information about both fragments which are parts of of a single file will be stored to file system.

Apart from user files, file system also stores its own parameters (as block size etc.), file descriptors (that include file size, file location, its fragments etc.), file names and directory hierarchy. It may store also security information, extended attributes and other parameters as well.

There are many requirements to storage performance, stability and other qualities of the file system. To best suit a specific purpose there have been developed many different types of file systems. So at present we can see plenty of file systems that are used on different types of computer systems and serve specific purposes.


Windows file systems

Microsoft Windows OS use two major file systems: the FAT inherited from old DOS with its later extension FAT32 and modern NTFS file systems.

FAT (File Allocation Table):
The file system is one of most simple types of file systems. It consists of file system descriptor sector (boot sector or superblock), file system block allocation table (referenced as File Allocation Table) and plain storage space to store files and folders. The files on FAT are stored in directories. Each directory is the array of 32-byte records, each defines file or file extended attributes (like long file name). File record references a first block of file. Any next block could be found through block allocation table by using it as linked-list.
Block allocation table contains array of block descriptors. Zero value indicates block is not used and non-zero indicates reference to next block of the file or special value for end of file.
The number in FAT12, FAT16, FAT32 file system name means how many bits are used to number file system block. This means that FAT12 may use up to 4096 different block references, FAT16 - 65536 and FAT32 - 4294967296. Actual maximum count of blocks is even less and depends on file system driver implementation.

FAT12 was used for old floppy disks. FAT16 (or simply FAT) and FAT32 are widely used for flash memory cards, USB flash sticks and so on. It is supported by mobile phones, digital cameras and other portable devices.
FAT or FAT32 could be identified as file system, used on Windows-compatible external storages or disk partitions with size below 2GB (for FAT) or 32GB (for FAT32). Windows can not create even FAT32 file system over 32GB (however Linux supports FAT32 up to 2TB).

NTFS (New Technology File System):
It was introduced in Windows NT and at present is main file system for Windows. It is default file system for disk partions and the only one file system that is supported for disk partitions over 32GB. The file system is quite extensible and supports many file properties, including access control, encryption etc. Each file on NTFS is stored as file descriptor in Master File Table and file content. Master file table contains all information about file: size, allocation, name and so on. The fist and the last sectors of the file system contain file system settings (the boot record or superblock). The file system uses 48 and 64 bit values to reference files thus it supports quite large disk storages.

Please refer to Deleted files: chances for recovery article for information about data recovery from these file systems.


MacOS file systems

The Apple MacOS operating system uses HFS+ file system, the modern extension to their own HFS file system that was used on old Macintosh computers. Currently HFS+ is used as main file system for Apple products, including Mac computers, iPhone, iPod and so on.

This file system, like most modern file system best suits personal computers and has close integration to MacOS user interface: except files and folders it also stores Finder information about directories view, window positions and so on.

HFS+ file system is used on Apple desktop products, as well as it was re-used for Apple X Server products. The top storage server products also use Apple Xsan file system, the clustered file system derived from StorNext or CentraVision file systems.

Please refer to Deleted files: chances for recovery article for information about data recovery from these file systems.


Linux file systems

The open-source Linux OS was always the target to implemt, test and use different concept of file systems. Among huge amount of different file system types, the most popular Linux file systems nowadays are:

• Ext2, Ext3, Ext4 - the 'native' Linux file system. The file system is actively developed and impoved. The Ext3 file system is just an extension to Ext2 that uses transactional file write operations with so-called journal. Ext4 is the further development of Ext3, extended with optimized file allocation information support (extents) and support of "extended file attributes". This file system is very often used as 'root' file system for most Linux installations.
• ReiserFS - the alternative Linux file system with the main purpose to store huge amount of small files. It has good capability of files search and it allows to 'compact' files allocation by storing file tails or small file along with metadata and to not use large file system blocks for this.
• XFS - the file system from SGI company who initially used it for their IRIX servers. Now XFS specifications are open it the file system support was implemented in Linux. The XFS file system has great performance and thus widely used as file storage file system.
• JFS - the file system was developed by IBM for their powerful cumputing systems. Saying JFS one usually mean JFS, second edition (JFS2). Currently this file system is open-source and is implemented in most modern Linux distributions.

The common property of most Linux file systems is that file name is not regarded as file attribute and is meant as an alias for a file in a specific directory. The reason is concept of 'hard links' used in this kind of OS: the file object could be linked from many locations, even many times from the same directory under different names. This is one of the causes why file names recovery after file deletion or file system damage could be difficult or even impossible.

Please refer to Deleted files: chances for recovery article for information about data recovery from these file systems.


BSD, Solaris, Unix file systems

The most common file system for these OS is UFS (the Unix File System). It is also often called FFS (the Fast File System; it is 'fast' in comparison with a previous file system used for Unix). The UFS is the source of ideas for many other file system implementations.

Currently UFS (in different editions) is supported by all Unix-family OS and is the main file system of BSD OS and Sun Solaris OS. The modern tendency is to implement replacements for UFS in different OS (ZFS for Solaris, JFS and derived file systems for Unix and so on).

Please refer to Deleted files: chances for recovery article for information about data recovery from these file systems.


Clustered file systems

The clusterd file systems specifics is that they are used in computer cluster systems. These file systems have embedded support of distributed storage.

Among such distributed file systems are:

• ZFS - Sun company 'Zettabyte File System' - the new file system developed for distrubuted storages of Sun Solaris OS.
• Apple Xsan - the Apple company evolution of CentraVision and later StorNext file systems.
• VMFS - the 'Virtual Machine File System' developed by VMware company for its VMware ESX Server.
• GFS - the Rad Hat Linux 'Global File System'.
• JFS1 - the original (legacy) design of IBM JFS file system used in older AIX storage systems.

The common property of these file systems is distributed storages support, extensibility and modularity.

Please refer to Deleted files: chances for recovery article for information about data recovery from these file systems.