Episode 101: Filesystems — NTFS, exFAT, ext4, APFS
Filesystems define how data is stored, organized, and accessed on a storage device. Every operating system depends on a filesystem to manage its files, track used and unused space, and support user operations like saving, copying, or deleting. Each operating system prefers a different default filesystem, and these choices affect performance, compatibility, permission handling, and maximum file size. In some cases, choosing the wrong filesystem can prevent a drive from working across platforms or limit the types of files it can store. The A Plus Core Two exam includes questions on filesystem types, their use cases, and how to format or troubleshoot them.
One of the most important filesystems for technicians to recognize is N T F S, which stands for New Technology File System. This is the default filesystem for Windows internal drives. N T F S supports large files and volumes, advanced file permissions, encryption, compression, and disk quotas. It also includes journaling, which helps protect data from corruption in the event of a system crash or power failure. N T F S is used on nearly all internal Windows drives and is the preferred choice when security and recoverability are important.
exFAT, short for Extended File Allocation Table, is commonly used for flash drives, external hard drives, and S D cards. It was designed to overcome the limitations of F A T thirty-two while remaining simple and compatible across platforms. Unlike N T F S, exFAT does not support file-level permissions or journaling, but it does support much larger file sizes than F A T thirty-two. This makes exFAT a good choice when transferring large video files or backup archives between Windows, mac O S, and Linux systems with the right drivers installed.
F A T thirty-two is an older filesystem that still appears in specific scenarios. It supports a maximum file size of four gigabytes and a maximum volume size of two terabytes. Because of its simplicity, it is still used for U E F I boot partitions, BIOS-compatible flash drives, and small removable media. It is nearly universally supported across all major operating systems, which makes it useful for compatibility. However, the size limits and lack of modern features make F A T thirty-two unsuitable for modern storage tasks beyond temporary use.
ext4, or the fourth extended filesystem, is the default for most modern Linux distributions. It supports journaling, file permissions, and very large volume sizes, making it ideal for both personal and server environments. ext4 is not natively readable by Windows or mac O S, although third-party drivers and utilities can enable limited access. ext4 is used in firewalls, lab setups, application servers, and development systems. Linux tools such as mkfs and fsck are used to format and repair ext4 filesystems as needed.
A P F S, or Apple File System, is the default filesystem for modern mac O S and i O S devices. It is optimized for solid state drives and includes support for snapshots, file-level encryption, and fast directory sizing. A P F S replaced H F S Plus as Apple’s default filesystem in mac O S High Sierra and later. It is designed for speed, reliability, and space efficiency. Apple mobile devices, including iPhones and iPads, also use A P F S to manage their flash storage, ensuring consistency across the Apple ecosystem.
H F S Plus, sometimes written as H F S Plus, is Apple’s legacy filesystem. It was used before the adoption of A P F S and is still supported in mac O S for backwards compatibility. While it offers basic journaling and volume management, it lacks many of the modern features found in A P F S. Some older external drives and disk images may still use H F S Plus. Technicians supporting Apple environments should be able to identify whether a volume is formatted with H F S Plus or A P F S and understand the limitations of each.
Permissions support varies between filesystems. N T F S, ext4, and A P F S all support access control lists, or A C Ls, which define which users or groups can access specific files or folders. This is essential in enterprise and multi-user environments where file security is important. In contrast, exFAT and F A T thirty-two do not support permissions or user-level access controls. These filesystems are not suitable for situations where secure access needs to be enforced at the file level.
Each operating system includes built-in tools for formatting drives. In Windows, you can use the Disk Management tool or the FORMAT command in Command Prompt. Linux uses tools like mkfs and GParted to create and manage filesystems. mac O S provides Disk Utility for graphical formatting, or diskutil from the command line. These tools allow technicians to format drives to the appropriate filesystem for the environment. Understanding which tool to use and which options to select is critical for preparing drives for deployment.
For more cyber related content and books, please check out cyber author dot me. Also, there are other prep casts on Cybersecurity and more at Bare Metal Cyber dot com.
Different filesystems are optimized for different use cases. N T F S is best for internal Windows drives where you need support for permissions, encryption, and large file sizes. exFAT is ideal for external storage devices that need to be shared between multiple operating systems, such as flash drives or external hard drives. ext4 is the go-to choice for most Linux installations and servers due to its stability and flexibility. A P F S is preferred for Apple devices using solid state drives, including MacBooks, iPhones, and iPads. Matching the filesystem to the environment ensures compatibility and stability.
Boot support also depends on the filesystem being used. Most U E F I systems require a boot partition formatted as F A T thirty-two, even when the main operating system partition uses a different format. Windows typically boots from an N T F S partition. mac O S boots from A P F S. Linux boot loaders can reside on an ext4 partition, though they may still use a small F A T thirty-two boot partition for compatibility. Understanding boot requirements is important when creating installation media or troubleshooting systems that won’t start properly.
Cross-platform compatibility can be a major challenge when transferring files between systems. Windows supports reading and writing to N T F S and exFAT. mac O S can read N T F S but cannot write to it without third-party tools, while it supports exFAT natively. Linux supports all major filesystems, but may require mounting and additional drivers to access N T F S or A P F S volumes. Technicians must choose the appropriate format based on the systems involved in the transfer. exFAT is often the most universal choice for cross-platform data sharing.
Here is a typical scenario that appears in both support roles and the A Plus exam. A user wants to transfer a ten-gigabyte video file between a Windows laptop and a Mac. If they format the flash drive with F A T thirty-two, the file will not copy due to the four-gigabyte file size limit. Formatting the drive with exFAT resolves the issue, as both systems can read and write to it and it supports larger files. Alternatively, using N T F S would require extra drivers on the Mac, making exFAT the simpler solution.
Journaling is a feature that helps protect data integrity. It works by recording changes in a log before committing them to the filesystem. If a crash or power loss occurs during a write operation, the system can use the journal to restore consistency. Journaling is found in N T F S, ext4, and A P F S. It is not present in exFAT or F A T thirty-two. This makes journaling filesystems safer for critical systems or frequent write activity. Systems without journaling are more prone to corruption after an unexpected shutdown.
File and partition size limits vary significantly between filesystems. N T F S and A P F S support multi-terabyte volumes and individual files up to several terabytes in size. ext4 also supports extremely large volumes, with a theoretical limit of sixteen terabyte files and exabyte-level volumes. F A T thirty-two, by comparison, limits individual files to four gigabytes and partitions to two terabytes. exFAT supports larger files but may not match the full limits of N T F S or A P F S. When choosing a filesystem, these size limits are a major factor.
Naming conventions and case sensitivity also differ. N T F S is case-insensitive by default but preserves case for appearance. That means “file dot T X T” and “File dot T X T” are treated as the same file. ext4 and A P F S, by default, are case-sensitive. On those systems, the same two file names would refer to separate files. mac O S can be configured for case-insensitive or case-sensitive behavior depending on how the volume is formatted. Understanding these naming behaviors is essential when transferring files or writing scripts that reference filenames.
Tools exist to convert or reformat filesystems, although options and limitations vary. In Windows, you can convert a F A T thirty-two volume to N T F S using the CONVERT command. This preserves data, although the reverse is not possible without reformatting. In Linux, tools like G Parted or mkfs are used to format or set up partitions. However, converting ext4 to another format typically requires backing up data, formatting, and restoring files. In mac O S, Disk Utility allows technicians to reformat drives and switch between A P F S and H F S Plus. Always back up data before reformatting.
Filesystem errors can prevent access to files or corrupt system data. On Windows systems using N T F S, the CHKDSK tool scans for logical and physical disk errors. In Linux, the F S C K tool is used to scan and repair ext4 volumes. In mac O S, Disk Utility includes a tool called First Aid, which checks and repairs A P F S or H F S Plus volumes. These utilities are critical when resolving startup issues, detecting hardware faults, or troubleshooting unexplained system slowdowns.
To summarize, technicians must choose the correct filesystem for the operating system, hardware, and intended usage. Filesystems like N T F S, exFAT, ext4, and A P F S each offer different features, size limits, and compatibility profiles. You must understand how these formats behave, what tools are used to manage them, and how to diagnose issues when they arise. The A Plus exam frequently tests this knowledge through matching questions, formatting scenarios, and problem-solving situations where choosing the right format ensures successful deployment or data transfer.
