Part 8 · File Systems and Storage

Chapter 19 · File Systems

2 min read

Status: ✅ COMPLETE

Scope: How Windows turns raw storage blocks into named files and folders: file system types, clusters, NTFS internals (the Master File Table and journal), permissions, links, file attributes, and the complete chain that runs when you create a new text file
Time to complete: 90–120 minutes of reading + lab
Prerequisites: Chapter 3 (RAM and Memory Internals, for caching), Chapter 13 (drivers), Chapter 17 (the Registry) and Chapter 18 (storage hardware: the disk itself)
What you'll know after: What a file system is and why a disk needs one, how NTFS stores and protects files, how links, permissions and attributes work, and exactly what happens from a right-click to bits on the disk

INTRODUCTION

In Chapter 18 you met the disk: a hard drive or SSD. It stores numbered blocks and nothing else. It has no idea what a "file" or a "folder" is. Something has to turn those blocks into Holiday.jpg inside Pictures. That something is the file system.

This chapter uses real photos and diagrams, so you can see what you are learning about. It also uses plain words. Every technical term is explained the first time it appears.

This chapter explains:

  • What a file system does, and how clusters, slack space and the folder tree fit together
  • The four main file systems on Windows (NTFS, FAT32, exFAT, ReFS) and when to use each
  • What metadata is, and why a folder is really just a special file holding a list
  • How NTFS keeps a Master File Table, stores tiny files inside it, tracks free space and uses a journal to survive crashes
  • How permissions work: ACLs, ACEs and inheritance
  • Hard links, symbolic links and junctions (and why a shortcut is different)
  • File attributes: Read-only, Hidden, System, Archive, compression and encryption
  • The complete chain of events when you right-click and create a new text file
  • A safe hands-on lab using attrib, icacls, mklink and fsutil

CHAPTER OUTLINE

Chapter Status: Complete
Estimated reading time: 100 minutes
Practical time: 35 minutes
Knowledge check time: 30 minutes