File Systems: NTFS, FAT32, exFAT

A file system is the method an operating system uses to organize, store, retrieve, and manage data on a storage device. Without a file system, data would be a single large block of bytes with no way to locate individual files. The file system provides a structure—directories and files—and keeps track of where each file's data resides on the disk. It also manages metadata such as file names, timestamps, permissions, and attributes.

NTFS is the default file system for modern Windows operating systems (Windows NT and later, including Windows 10/11). It was introduced with Windows NT 3.1 in 1993 to replace the older FAT file systems.

Key Features: - Journaling: NTFS maintains a log (journal) of changes before they are written to the main file system. This allows the system to recover quickly after a crash or power failure by replaying or undoing incomplete transactions. - Security: NTFS supports file and folder permissions (Access Control Lists – ACLs) that control which users and groups can read, write, execute, or delete objects. It also supports encryption via the Encrypting File System (EFS). - Large Volume and File Sizes: NTFS supports volumes up to 256 TB (with 64 KB clusters) and file sizes up to 16 EB (exabytes) theoretically, but practical limits are lower due to operating system constraints. For Windows, the maximum volume size is 256 TB. - Compression: NTFS can compress files and folders to save disk space, with minimal performance impact on modern hardware. - Disk Quotas: Administrators can limit the amount of disk space a user can consume. - Alternate Data Streams (ADS): NTFS allows files to have multiple data streams. This feature is used by Windows for things like Zone.Identifier (downloaded files from the internet) and can be exploited by malware. - Hard Links and Junctions: NTFS supports hard links (multiple directory entries pointing to the same file) and junction points (directory symlinks).

Internal Structure: NTFS uses a Master File Table (MFT) that stores metadata about every file and directory on the volume. The MFT is a relational database with rows (records) for each file. Each record contains attributes such as: - $STANDARD_INFORMATION (timestamps, file attributes) - $FILE_NAME (file name in Unicode) - $DATA (the actual file content) - $SECURITY_DESCRIPTOR (permissions)

Small files (typically < 1 KB) are stored directly within the MFT record. Larger files have data runs that point to clusters on the disk.

Cluster Sizes: NTFS supports cluster sizes from 512 bytes to 2 MB. Default cluster sizes depend on volume size: - ≤ 512 MB: 512 bytes - 513 MB – 1 GB: 1 KB - 1 GB – 2 GB: 2 KB - 2 GB – 2 TB: 4 KB - 2 TB – 16 TB: 8 KB - 16 TB – 32 TB: 16 KB - 32 TB – 64 TB: 32 KB - 64 TB – 128 TB: 64 KB - 128 TB – 256 TB: 128 KB

Limitations: - Not natively readable by macOS (read-only via third-party software) or many Linux distributions (read/write via NTFS-3G, but not out-of-the-box). - Overhead: Journaling and metadata consume some space (typically 1-5% of the volume).

FAT32 is an evolution of the original FAT file system, introduced with Windows 95 OSR2 in 1996. It is widely used for removable storage due to its compatibility.

Key Features: - Simplicity: FAT32 uses a File Allocation Table (FAT) that maps clusters to file entries. The table is essentially a linked list. - Compatibility: FAT32 is supported by almost all operating systems: Windows, macOS, Linux, game consoles, cameras, and embedded devices. - No Journaling: There is no transaction log. A crash during a write operation can corrupt the file system. - No Security: FAT32 does not support file permissions or encryption at the file system level.

Limitations: - Maximum File Size: 4 GB minus 1 byte (2^32 - 1 bytes). This is a critical exam point: you cannot store a file larger than 4 GB on a FAT32 volume. - Maximum Volume Size: 2 TB (with 512-byte sectors) or 16 TB (with 4 KB sectors) theoretically, but Windows limits formatting to 32 GB. This is a deliberate Microsoft limitation to encourage NTFS. - Maximum Number of Files: Approximately 268,173,300 files (2^28) due to the cluster count limit. - Cluster Sizes: From 512 bytes to 32 KB.

Internal Structure: The FAT32 volume is divided into:

Each file has a directory entry that includes the starting cluster number. The FAT is a table of cluster entries; each entry points to the next cluster in the file or marks the end (0x0FFFFFFF).

Use Cases: - USB flash drives (but only if files are under 4 GB) - SD cards (especially older cameras) - Cross-platform sharing where compatibility is more important than features

exFAT was introduced by Microsoft in 2006 to address FAT32's limitations while maintaining simplicity and cross-platform compatibility. It is the default file system for SDXC cards (over 32 GB).

Key Features: - Large File Support: Maximum file size is 16 EB (exabytes) – effectively unlimited. - Large Volume Support: Maximum volume size is 128 PB (petabytes). - No Journaling: Like FAT32, exFAT does not have a journal, making it vulnerable to corruption on improper ejection. - No Security: No file permissions or encryption. - Optimized for Flash Storage: exFAT uses a single File Allocation Table (with optional backup) and a bitmap for free space management, reducing write overhead. - Compatibility: Supported by Windows (XP SP2 and later), macOS (10.6.5 and later), Linux (via kernel module or FUSE), and many consumer devices.

Limitations: - Not as widely compatible as FAT32 (e.g., some older cameras and game consoles do not support exFAT). - No journaling increases risk of data loss on unexpected removal.

Internal Structure: exFAT uses:

Cluster Sizes: exFAT supports cluster sizes from 512 bytes to 32 MB. Default cluster size for volumes > 256 GB is 128 KB.

Use Cases: - Large USB flash drives (over 32 GB) - SDXC and SDHC cards - External hard drives used across Windows and macOS

Windows: - To view file system type: fsutil fsinfo volumeinfo C: or vol C: - To format a drive: format D: /FS:NTFS (or FAT32, exFAT) - To convert FAT32 to NTFS without data loss: convert D: /FS:NTFS - To check file system integrity: chkdsk D:

Linux: - To view file system: lsblk -f or blkid - To format: mkfs.ntfs /dev/sdb1, mkfs.fat -F32 /dev/sdb1, mkfs.exfat /dev/sdb1

macOS: - To view: diskutil list - To format: diskutil eraseDisk FAT32 MBR /dev/disk2 (or JHFS+, exFAT)

When you install Windows, the installer requires a partition formatted with NTFS (for the system drive). You can have separate partitions with different file systems (e.g., a FAT32 partition for recovery tools). During boot, the BIOS/UEFI loads the boot sector, which reads the file system to load the boot manager (bootmgr for Windows).

For removable drives, the choice of file system affects compatibility and feature support. For example, if you connect a FAT32 USB drive to a Windows 10 system, you can read and write files smaller than 4 GB. If you try to copy a 5 GB file, you'll get an error 'The file is too large for the destination file system.'

The CompTIA A+ Core 2 exam tests your ability to:

#### Step 1: Determine Requirements Identify the use case: files larger than 4 GB? Operating systems to be used? Need for security? For a USB drive shared between Windows and macOS with files up to 10 GB, exFAT is best. For a bootable USB installer, FAT32 is often required for UEFI boot.

#### Step 2: Check Current File System On Windows, open File Explorer, right-click the drive, select Properties, and note the file system. On macOS, use Disk Utility. On Linux, use lsblk -f.

#### Step 3: Backup Data Formatting erases all data. Copy important files to another location.

#### Step 4: Choose File System and Format On Windows, right-click the drive in File Explorer, select Format, choose File system (NTFS, FAT32, or exFAT), set Allocation unit size (default is fine), check Quick Format if desired, and click Start. Alternatively, use command line: format E: /FS:exFAT /Q.

#### Step 5: Verify Format After formatting, check properties again to confirm the new file system. Test by copying a file larger than 4 GB to ensure no errors.

#### Step 6: Safely Eject Always use 'Safely Remove Hardware' to ensure all writes are complete, especially for FAT32 and exFAT which lack journaling.

A company uses a Windows Server 2019 file server with multiple shared folders. All volumes are formatted as NTFS. This allows the IT department to set granular NTFS permissions (e.g., Read for accounting, Modify for managers). They also enable disk quotas to prevent users from filling the server with personal files. Volume shadow copy is used for point-in-time backups. The server has a 10 TB RAID 5 array. The default cluster size of 4 KB is appropriate for mixed file sizes (documents, spreadsheets, and some large CAD files). If they had used FAT32, they would be limited to 4 GB per file and no permissions, which is unacceptable. A common misconfiguration is not setting proper ACLs, leading to unauthorized access. They use icacls and fsutil to troubleshoot.

A marketing agency uses large external drives (2 TB) to transfer video projects between Windows and macOS workstations. They need to store files larger than 4 GB (video files often exceed 10 GB). They choose exFAT because it supports large files and is natively read/write on both Windows and macOS without additional software. They do not need security or journaling. The drives are used for short-term transfers, not long-term archival. A common problem is improper ejection: because exFAT lacks journaling, removing the drive without 'Safely Remove Hardware' can corrupt the file allocation table, causing data loss. The agency trains employees to always eject safely. They also keep a backup of critical projects on an NTFS drive.

A manufacturer of industrial controllers uses SD cards to distribute firmware updates. The cards are formatted as FAT32 because the embedded system's bootloader only supports FAT32. The firmware files are typically under 100 MB, so the 4 GB limit is not an issue. The cards are small (2 GB). However, as firmware grows, they may need to switch to exFAT if files exceed 4 GB. The challenge is that older controllers do not support exFAT, so they must update the bootloader first. This scenario highlights the importance of compatibility: FAT32 is the most universally supported, but with limitations.