A file system is the method an operating system uses to organize, store, and retrieve data on a storage device. This guide defines file systems, explains how they organize data using inodes and allocation tables, covers 5 major file systems with full specifications, explains journaling for crash recovery, and provides a use-case selection guide.
What Is a File System?
A file system is the data structure and set of rules the operating system uses to control how data is stored and retrieved on a storage medium. Without a file system, raw storage contains an undifferentiated block of data with no way to determine where one file ends and another begins. The file system imposes structure: it tracks file names, sizes, locations on disk, creation dates, permissions, and ownership through metadata stored alongside the file data.
File systems operate at the block level. Storage devices divide their capacity into fixed-size blocks, typically 512 bytes (physical sector) or 4,096 bytes (Advanced Format). The file system groups blocks into clusters or allocation units and maintains a map of which clusters belong to each file.
How File Systems Organize Data
File systems use three core data structures to track file storage locations:
Inodes (Unix/Linux)
An inode (index node) is a fixed-size data structure on Unix and Linux file systems that stores file metadata: file size, owner UID and GID, permissions (read/write/execute bits), timestamps (atime, mtime, ctime), and pointers to the data blocks containing the file’s content. An inode does not store the file name — the file name is stored in a directory entry that points to the inode number.
A single file can have multiple hard links (directory entries) pointing to the same inode. ext4 inodes are 256 bytes each by default. A partition formatted with ext4 has a fixed inode table created at format time; running out of inodes prevents new file creation even if disk space remains.
File Allocation Table (FAT)
The File Allocation Table is a linked-list structure used by FAT12, FAT16, FAT32, and exFAT file systems. The FAT is a table stored near the beginning of the partition where each entry corresponds to one cluster on the disk.
A FAT entry contains either: the cluster number of the next cluster in the file chain, a special end-of-file marker (0xFFFFFFFF in FAT32), or zero to indicate the cluster is free. To read a file, the OS reads the first cluster number from the directory entry, reads that cluster from disk, then follows the FAT chain to each subsequent cluster until the end-of-file marker.
B-Trees and Extents
Modern file systems (NTFS, ext4, APFS, Btrfs) use B-tree structures for directory indexing, enabling O(log n) file lookup in directories containing millions of files. ext4 introduced extents in Linux kernel 2.6.28: an extent is a contiguous range of blocks described by a starting block number and length, replacing the old indirect block pointer model. A single ext4 extent can describe up to 128MB of contiguous data with a 4KB block size. Large files in ext4 are described by an extent tree with up to 4 levels.
5 Major File Systems: Specifications
Five file systems cover the majority of storage devices in production use across Windows, Linux, macOS, and portable media:
FAT32
FAT32 was introduced with Windows 95 OSR2 in 1996 as a replacement for FAT16. Maximum single file size: 4GB − 1 byte (enforced by a 32-bit file size field). Maximum volume size: 2TB with 512-byte sectors.
FAT32 has no journaling, no file permissions, and no encryption support. Its primary value is near-universal compatibility: every OS (Windows, macOS, Linux, Android, game consoles) reads FAT32. FAT32 is used on USB drives and SD cards where cross-platform compatibility is required and individual files remain under 4GB.
NTFS
NTFS (New Technology File System) was introduced with Windows NT 3.1 in 1993 and remains the default file system for Windows system drives. Maximum single file size: 16TB with default cluster sizes (theoretical maximum 16EB). Maximum volume size: 256TB with standard 64KB clusters.
NTFS provides journaling (crash recovery through a transaction log called $LogFile), per-file NTFS permissions (ACLs with user/group inheritance), file and folder encryption (EFS — Encrypting File System), data deduplication, sparse files, symbolic links, and alternate data streams (ADS). NTFS is macOS-read-only without third-party drivers (Tuxera, Paragon).
exFAT
exFAT (Extended FAT) was introduced by Microsoft in 2006 as the file system for flash storage (SD cards, USB drives) requiring files larger than FAT32’s 4GB limit with cross-platform compatibility. Maximum single file size: 16EB (264 − 1 bytes).
Maximum volume size: 128PB. exFAT has no journaling. Microsoft published the exFAT specification to the SD Association in 2019, and the Linux kernel 5.7 includes a native exFAT driver. exFAT is the mandatory file system for SDXC and SDUC cards per the SD Association specification.
ext4
ext4 (Fourth Extended File System) is the default file system for most Linux distributions including Ubuntu, Debian, Fedora, and CentOS/RHEL. Introduced in Linux kernel 2.6.28 (2008). Maximum single file size: 16TB with 4KB block size.
Maximum volume size: 1EB. ext4 provides journaling (three modes: writeback, ordered, journal), extents for efficient large-file storage, delayed allocation to reduce fragmentation, online defragmentation support, and 64-bit block addressing. ext4 uses checksums on the journal for improved crash resistance. Inode count is fixed at format time: default is one inode per 16KB of space.
APFS
APFS (Apple File System) replaced HFS+ as the default macOS and iOS file system starting with macOS High Sierra (2017) and iOS 10.3 (2017). APFS uses copy-on-write (COW) semantics: modified data is written to a new location before the old location is freed, ensuring the file system is always in a consistent state without a separate journal. APFS supports native encryption at the volume level, with three options: no encryption, single-key, or multi-key (separate keys for file data and metadata).
APFS provides file system snapshots (point-in-time read-only views used by Time Machine) and space sharing (multiple volumes share a pool of capacity without pre-allocated sizes). Maximum single file size: 8EB. APFS is not supported on spinning hard drives by Apple — Apple recommends HFS+ for HDDs due to APFS’s optimization for SSDs.
File System Journaling Explained
Journaling is a crash-recovery mechanism that protects file system consistency when a write operation is interrupted by a power failure or OS crash. A journaling file system writes a record of intended changes to a dedicated journal area on disk before writing the actual data. After a crash, the OS replays the journal to complete interrupted transactions or rolls them back, restoring a consistent state.
Three journaling modes differ in what is journaled and the resulting performance-safety trade-off:
- Writeback mode: Only metadata (inodes, directory entries) is journaled. File data may be lost or corrupted after a crash. Fastest mode. Used in older Linux ext3 configurations.
- Ordered mode (default ext4): Metadata is journaled; data is written to disk before the journal entry commits. File data is never corrupted after a crash, though new files may be lost if the crash occurred during the write. This is ext4’s default mode.
- Journal mode (full): Both data and metadata are journaled. Slowest mode — every write happens twice (journal then data area). Provides the strongest crash consistency guarantee.
APFS does not use a traditional journal. Copy-on-write provides equivalent crash consistency: because original data is never overwritten, the file system is always in a valid state at any point of interruption.
File System Comparison Table
| File System | Max File Size | Max Volume | Journaling | Permissions | Default Use |
|---|---|---|---|---|---|
| FAT32 | 4GB − 1 byte | 2TB | No | No | USB drives, SD cards (legacy) |
| exFAT | 16EB | 128PB | No | No | SDXC/SDUC cards, USB drives |
| NTFS | 16TB (practical) | 256TB | Yes (metadata) | Yes (ACL) | Windows system drive |
| ext4 | 16TB | 1EB | Yes (3 modes) | Yes (POSIX) | Linux system drive |
| APFS | 8EB | 8EB | Copy-on-write | Yes (POSIX) | macOS/iOS SSD |
How to Choose a File System by Use Case
The correct file system choice depends on OS compatibility requirements, file size limits, and whether journaling is needed:
- Windows system drive: NTFS. Journaling, ACL permissions, encryption, and large file support are all required.
- Linux system drive: ext4. Stable, well-tested, journaled, supported by all major Linux distributions. Btrfs is an alternative on Fedora and openSUSE for snapshot and RAID features.
- macOS SSD system drive: APFS. Copy-on-write consistency, snapshot support, and native encryption are all built in.
- USB drive shared between Windows and macOS: exFAT. Supports files larger than 4GB and is natively read-write on both platforms without third-party drivers.
- USB drive for maximum compatibility (files under 4GB): FAT32. Readable by every OS, game console, smart TV, and camera without any driver installation.
- Network-attached storage (NAS) running Linux: ext4 or Btrfs. ext4 for simplicity and stability; Btrfs for built-in checksums, snapshots, and software RAID spanning multiple drives.
Key Takeaways
- A file system organizes data on storage devices using metadata structures — inodes on Unix/Linux, FAT entries on Windows portable media, B-trees on NTFS/APFS.
- FAT32 has a 4GB maximum file size and no journaling — use it only for cross-platform compatibility with files under 4GB.
- NTFS is the Windows default with 16TB max file size, journaling, ACL permissions, and EFS encryption.
- ext4 is the Linux default with journaling in ordered mode, a 16TB max file size, and extents for efficient large-file storage.
- APFS uses copy-on-write instead of journaling, providing snapshots, native volume encryption, and space sharing between volumes on the same SSD.
- exFAT is the correct choice for removable storage requiring files larger than 4GB and compatibility between Windows and macOS.
Frequently Asked Questions
What is the best file system for a USB drive?
For files under 4GB requiring maximum compatibility (Windows, macOS, Linux, game consoles): use FAT32. For files over 4GB shared between Windows and macOS: use exFAT. For a USB drive used only with Linux: use ext4 for journaling and POSIX permissions.
What is NTFS and why does Windows use it?
NTFS is Windows’ default file system, supporting a 16TB maximum file size, journaling for crash recovery, ACL-based file permissions, and EFS encryption. Windows uses NTFS on system drives because FAT32 lacks permissions and journaling, which are required for a multi-user OS with security isolation.
What is journaling in a file system?
Journaling records intended changes to a log before writing them to disk. After a crash, the OS replays the journal to complete interrupted operations or roll them back, preventing file system corruption. ext4’s default ordered mode journals metadata only; full journal mode journals both data and metadata at lower performance.
Can macOS read NTFS drives?
macOS can read NTFS drives natively but cannot write to them without third-party drivers (Tuxera NTFS, Paragon NTFS for Mac, or Microsoft’s own driver bundled with OneDrive). macOS write support for NTFS requires a paid third-party solution or reformatting to exFAT for cross-platform read-write access.
What is the difference between ext4 and APFS?
ext4 is the Linux default file system using journaling, POSIX permissions, and extents. APFS is the macOS/iOS default using copy-on-write (no journal), volume snapshots, native encryption, and space sharing across volumes. APFS is optimized for SSDs; ext4 works well on both HDDs and SSDs.
Last Thoughts on File Systems
File systems are the invisible infrastructure that makes persistent data storage usable. FAT32’s 4GB file limit and lack of journaling confine it to legacy compatibility roles. NTFS delivers the full feature set required for Windows: journaling, ACL permissions, and encryption. ext4 provides Linux with a stable, journaled file system supporting files up to 16TB.
APFS brings copy-on-write consistency, native encryption, and snapshots to Apple’s SSD-centric platform. Selecting the correct file system requires matching its capabilities — maximum file size, journaling mode, permissions model, and OS compatibility — to the specific storage use case.
