File system

A file system maps a namespace of paths onto blocks of a storage device and maintains metadata about them. In Unix-style designs (ext4, XFS) each file is an inode holding type, mode bits, owner UID/GID, size, timestamps, link count and pointers to data (extents in ext4); a directory is itself a file that maps names to inode numbers. The name therefore is not part of the file: several hard links can point to the same inode, and "deleting" a file only unlinks a name, with the data blocks freed once the link count and the number of open file descriptors both reach zero. NTFS stores equivalent information as attributes in records of the Master File Table, including a security descriptor with an ACL and optional alternate data streams, which Windows uses for the Zone.Identifier stream behind Mark of the Web.

Kernels expose a uniform interface through a virtual file system layer (VFS in Linux): open, read, write, fsync, rename and so on work the same whether the backing store is ext4, NFS, FUSE or a pseudo file system like /proc, which presents kernel data structures as files. Crash consistency is the central engineering problem. Journaling file systems write metadata changes to a log before applying them; ext4's default ordered mode journals metadata only but forces data to disk before the metadata that references it. Copy-on-write designs (ZFS, Btrfs, APFS, ReFS) never overwrite live blocks and update a tree of checksummed pointers atomically, which enables cheap snapshots and detection of silent corruption. Applications still need fsync, and on POSIX systems an fsync on the containing directory after rename, to make an update durable; skipping this is a classic source of data loss after power failure.

Permissions are enforced by the kernel at open time against the file system's metadata: classic owner/group/other rwx bits plus setuid, setgid and sticky bits on Unix, POSIX ACLs and extended attributes on Linux, and discretionary ACLs with inheritance on NTFS. Because the check happens at open, a process that already holds a file descriptor keeps access after permissions change. Time-of-check to time-of-use races, symlink attacks in world-writable directories such as /tmp, and path traversal in applications that build file names from user input are recurring vulnerability classes.

Forensically, file systems retain more than users expect: timestamps (the MACB set), journal entries, NTFS's $UsnJrnl change journal and unallocated blocks can reveal activity after files are deleted, and attackers use timestomping to alter the $STANDARD_INFORMATION timestamps. Conversely, on SSDs TRIM and wear levelling mean both that deleted data may vanish quickly and that overwriting a file does not reliably destroy it, so secure deletion is achieved by encrypting the volume and destroying the key. The file system is distinct from the block device and volume manager below it and from object storage such as S3, which offers flat keys and whole-object replacement instead of POSIX semantics.