7.3 File Systems, Directory Trees & Access Control

File Systems, Directory Trees & Access Control

Exam Focus: Storage devices cannot function without a file system to structure, index, and retrieve data. For the exam, you must master the exact specifications and limitations of FAT32, NTFS, and exFAT, understand the difference between absolute and relative file paths, recognize standard file extensions and their execution risks, and navigate access control models including Windows NTFS permissions, permission inheritance, and Linux octal permission calculations.

---

File System Architectures & Comparative Specifications

A physical storage device (such as an NVMe SSD, magnetic hard disk, or USB flash drive) is fundamentally an unorganized array of millions of raw, addressable storage blocks. A File System is the architectural framework of software data structures, indexing algorithms, and metadata directories that enables an operating system to store, identify, organize, retrieve, and secure files.

Without a file system, the operating system would see only raw binary sectors without knowing where one file begins and another ends. File systems organize raw sectors into logical allocation units called clusters (or blocks), maintain master directory tables, track free space, and manage file attributes.

+-------------------------------------------------------------------------+
|                        MAJOR FILE SYSTEM TAXONOMY                       |
|                                                                         |
|   +-------------+  +-------------+  +-------------+  +--------------+   |
|   |    FAT32    |  |    NTFS     |  |    exFAT    |  |     APFS     |   |
|   | - 4 GB File |  | - Journaling|  | - No 4GB Lim|  | - Apple SSD  |   |
|   | - 2 TB Vol  |  | - ACLs/EFS  |  | - Flash Opt |  | - Copy-on-   |   |
|   | - Universal |  | - Win Def   |  | - Universal |  |   Write (CoW)|   |
|   +-------------+  +-------------+  +-------------+  +--------------+   |
+-------------------------------------------------------------------------+

1. FAT32 (File Allocation Table 32)

Introduced by Microsoft with Windows 95 OSR2, FAT32 represents one of the most resilient and universally supported file systems in computing history. It uses 32-bit binary numbers to identify clusters (with 28 bits usable).

• Critical Technical Limitations:
  • Maximum Individual File Size: Exactly 4 GB minus 1 byte (4,294,967,295 bytes). Any attempt to write or copy a single file measuring 4.0 GB or larger onto a FAT32 volume will fail immediately, regardless of how much free space remains on the drive.
  • Maximum Volume / Partition Size: Architecturally 2 TB (using standard 512-byte sectors). While third-party utilities can format 2 TB FAT32 partitions, Microsoft Windows native formatting tools arbitrarily restrict FAT32 partition creation to 32 GB to encourage users to adopt NTFS.
• Strengths: Universal read/write compatibility across virtually every computing device in existence—Windows, macOS, Linux, gaming consoles (PlayStation, Xbox, Nintendo Switch), automotive infotainment systems, digital cameras, and smart televisions.
• Weaknesses: Lacks modern enterprise capabilities. FAT32 has no journaling (meaning unexpected power loss or pulling out a USB drive during a write operation frequently causes severe volume corruption), no native file permissions or Access Control Lists (ACLs), no native encryption, and no file compression.

2. NTFS (New Technology File System)

NTFS is the default, proprietary primary file system for all modern Microsoft Windows operating systems (since Windows NT and Windows 2000).

• Key Enterprise Capabilities:
  • Journaling: NTFS maintains a circular transaction log ($LogFile). Before any file modification is committed to the disk platters or flash cells, the intended transaction is recorded in the journal. If power is suddenly lost mid-write, the file system reads the journal upon reboot and cleanly rolls back or completes the transaction in seconds, preventing file system corruption without requiring time-consuming disk check (chkdsk) scans.
  • Access Control Lists (ACLs): Enables granular, user-level and group-level security permissions on individual files and directories.
  • Encryption (EFS): The Encrypting File System provides transparent, public-key cryptographic encryption for individual sensitive files and folders on the volume.
  • Compression: Supports transparent per-file and per-folder NTFS compression to save disk space.
  • Volume Shadow Copy (VSS): Enables point-in-time snapshots of live storage volumes, allowing backup software to copy active, locked database files without interrupting production operations.
• Limits: Supports theoretical individual file and volume sizes up to 16 Exabytes (EB), with practical Windows implementations supporting volumes up to 256 TB.
• Cross-Platform Compatibility: Full read and write support in Windows. macOS can natively read NTFS drives, but cannot write to them without specialized third-party software drivers. Linux supports read/write access via the open-source ntfs-3g driver or kernel module.

3. exFAT (Extended File Allocation Table)

Introduced by Microsoft to address the severe limitations of FAT32 while avoiding the complex metadata overhead of NTFS, exFAT is optimized specifically for flash memory storage (such as high-capacity USB flash drives, SDXC memory cards, and external portable SSDs).

• Eliminates the 4 GB File Size Barrier: exFAT supports theoretical file and volume sizes up to 128 Petabytes (PB). An external drive formatted with exFAT can effortlessly store massive 50+ GB 4K video files, virtual machine disk images (.vmdk), and database backups.
• Universal Cross-Platform Native Support: Unlike NTFS, exFAT has full native read and write support built directly into Microsoft Windows, Apple macOS, and modern Linux kernels without requiring third-party drivers.
• Lightweight Flash Design: exFAT omits heavy enterprise overhead such as ACL permissions, EFS encryption, and journaling, minimizing write amplification to maximize the physical lifespan and write speeds of flash memory chips.

4. ext4 (Fourth Extended Filesystem)

ext4 is the default standard journaling file system for the vast majority of modern enterprise and desktop Linux distributions (including Ubuntu, Debian, Red Hat Enterprise Linux, and Fedora).

• Features: It features a robust journaling engine, supports individual file sizes up to 16 TB, and supports volume sizes up to 1 Exabyte (EB).
• Extents Architecture: Unlike legacy file systems that map every single cluster individually, ext4 uses extents (mapping large contiguous ranges of physical blocks with a single descriptor), which dramatically reduces metadata overhead, minimizes fragmentation, and accelerates large file read/write operations.

5. APFS (Apple File System)

Introduced in 2017, APFS is the proprietary modern default file system across all Apple computing platforms (macOS, iOS, iPadOS, watchOS, and tvOS), completely replacing the legacy HFS+ (Mac OS Extended) file system.

• Optimized for Solid-State Storage: APFS is engineered from the ground up for high-speed SSDs and flash storage arrays.
• Copy-on-Write (CoW) Cloning: When a user duplicates a 10 GB file in APFS, the file system does not copy the physical data. Instead, it creates an instant clone pointing to the identical existing blocks on the SSD, completing in milliseconds and consuming zero additional storage. Physical disk space is consumed only when one of the copies is modified in the future.
• Space Sharing & Native Encryption: Allows multiple logical volumes to share an underlying physical storage container dynamically, and incorporates native single-key and multi-key encryption for enhanced data security.

6. Optical Disc File Systems

• CDFS (Compact Disc File System / ISO 9660): The standardized, legacy read-only file system designed specifically for CD-ROM media.
• UDF (Universal Disk Format): The modern, open standard optical disc file system utilized for DVD-Video, DVD-ROM, Blu-ray discs, and packet-written optical rewritable media.

Comprehensive File System Comparison

---

Hierarchical Directory Structures & Path Resolution

Modern operating systems organize millions of stored files into a Hierarchical Directory Tree, structuring data into folders (directories) and subfolders branching outward from a designated root anchor.

+------------------------------------+    +------------------------------------+
|      WINDOWS DIRECTORY MODEL       |    |        UNIX / LINUX MODEL          |
+------------------------------------+    +------------------------------------+
| Anchors: Drive Letters (C:\\, D:\\)  |    | Anchor: Unified Single Root ( / )  |
| Delimiter: Backslash ( \\ )         |    | Delimiter: Forward Slash ( / )     |
| Case: Case-Insensitive             |    | Case: Strictly Case-Sensitive      |
| Example:                           |    | Example:                           |
| C:\\Users\\Alex\\Docs\\notes.txt       |    | /home/alex/docs/notes.txt          |
+------------------------------------+    +------------------------------------+

Root Directory Anchors & Delimiters

• The Windows Drive-Letter Model: Windows assigns an independent drive letter followed by a colon and a backslash (\\) to every physical partition, mounted storage volume, or optical drive:
  • C:\\ represents the primary local system boot volume.
  • D:\\ or E:\\ represents secondary internal drives, optical media, or removable USB storage.
  • Directories are separated by backslashes: C:\\Users\\John\\Documents\\budget.xlsx.
  • Case-Insensitivity: Windows file paths are case-insensitive. To Windows, C:\\Reports\\Sales.docx and c:\\reports\\sales.docx point to the identical file.
• The Unix / Linux Unified Root Model: Linux and macOS reject drive letters entirely. Instead, the entire operating system and all attached storage drives exist within a single unified directory tree anchored at the Root Directory, represented by a single forward slash (/):
  • External drives, partitions, and USB thumb drives do not receive drive letters; they are mounted as directories within the unified tree (e.g., /mnt/usb, /media/storage, or /Volumes/BackupDrive on macOS).
  • Directories are separated by forward slashes (/): /var/log/nginx/access.log.
  • Strict Case-Sensitivity: Unix file paths are strictly case-sensitive. The files Report.pdf, report.pdf, and REPORT.PDF can exist concurrently within the exact same directory as three completely separate, independent files.

Standard System Directory Conventions

• Microsoft Windows System Folders:
  • C:\\Windows\\: Contains core operating system binaries and configuration repositories.
  • C:\\Windows\\System32\\: The critical heart of Windows, containing fundamental kernel DLLs, system device drivers, and core utilities (cmd.exe, taskmgr.exe).
  • C:\\Program Files\\: Standard installation directory for 64-bit applications.
  • C:\\Program Files (x86)\\: Installation folder for legacy 32-bit software executing on a 64-bit OS via the WOW64 subsystem.
  • C:\\Users\\<Username>\\: The user profile directory containing personal Desktop, Documents, Downloads, and hidden application settings (AppData).
• Linux Filesystem Hierarchy Standard (FHS):
  • / (Root): The top-level ancestor of all directories.
  • /bin & /usr/bin: Essential user command binaries (ls, cp, grep).
  • /sbin & /usr/sbin: System administration binaries requiring root privileges (iptables, fdisk).
  • /etc: System-wide configuration text files and service startup scripts.
  • /home/<username>: Standard user home directories.
  • /var: Variable data that changes continuously during operation, notably system and application logs located in /var/log.
  • /dev: Device files representing physical hardware components (e.g., /dev/sda for a disk drive).
  • /tmp: Temporary files, frequently flushed upon system reboot.

Absolute vs. Relative File Paths

Navigating hierarchical directory structures requires distinguishing between absolute and relative file paths:

• Absolute File Path: Specifies the complete, full location of a file starting from the absolute root of the file system (the drive letter in Windows, or / in Linux). An absolute path is completely self-contained and resolves to the exact same file regardless of the user's active working directory.
  • Windows Absolute Path: C:\\Projects\\Marketing\\Assets\\logo.png
  • Linux Absolute Path: /var/www/html/index.html
• Relative File Path: Specifies the location of a target file relative to the user's Current Working Directory (CWD). Relative paths utilize two standardized navigation tokens:
  • Single Period (.): Represents the current working directory.
  • Double Period (..): Represents the parent directory located one level up the hierarchy.

Step-by-Step Path Resolution Scenario: Suppose an IT administrator is working in a terminal and their Current Working Directory is: C:\\Users\\Jordan\\Documents\\

1. If the administrator wants to access a file in a subfolder named Work, the relative path is: .\\Work\\report.docx (or simply Work\\report.docx)
2. If the administrator needs to reference a downloaded file located in C:\\Users\\Jordan\\Downloads\\setup.exe, they must first ascend one level up to C:\\Users\\Jordan\\ using .. and then descend into Downloads: ..\\Downloads\\setup.exe
3. If the administrator needs to reach C:\\Windows\\System32\\drivers\\etc\\hosts, attempting to navigate relatively requires ascending three levels (..\\..\\..\\Windows\\System32\\drivers\\etc\\hosts), making an absolute path (C:\\Windows\\System32\\drivers\\etc\\hosts) far more direct and less error-prone.

Hidden Files and File Naming Rules

• Hidden Files: In Windows, files are marked hidden by setting the Hidden file attribute in file properties (managed via File Explorer view options or the attrib +h filename command). In Linux and macOS, any file or directory whose name begins with a leading period (.) is automatically treated as hidden (colloquially called dotfiles, such as .bashrc, .profile, or .git/). In a Linux terminal, hidden files are viewed by running ls -a.
• Windows Reserved Characters: Windows strictly forbids the following nine characters from appearing in file or folder names: \\ / : * ? \" < > |
• Path Length Limitations: Historically, Windows enforced the MAX_PATH limit, restricting total file path strings to 260 characters. While modern Windows 10 and 11 can remove this limit via Group Policy or Registry edits, software compatibility issues can still occur when deep directory nesting exceeds 260 characters.

---

File Extensions & Associations

A File Extension is a suffix of characters (typically 3 to 4 letters) separated from the base filename by a period (e.g., .docx, .pdf, .exe).

• How Operating Systems Identify Files:
  • Windows: Relies heavily on the file extension. Windows consults the Windows Registry to map the extension to a specific default software application (File Association). If you rename presentation.pptx to presentation.txt, Windows will attempt to open it in Notepad.
  • Linux & macOS: While extensions are widely used for human convenience, Unix-based operating systems primarily identify file types by inspecting the internal binary header bytes of the file, known as Magic Numbers, using the file command (e.g., file mysteryfile reveals it is an ELF executable or PNG image regardless of its filename extension).

Common Essential File Extensions

• Executables & Scripting:
  • .exe: Windows executable program.
  • .msi: Microsoft Windows Installer package for software deployment.
  • .bat / .cmd: Windows batch command scripts.
  • .ps1: Microsoft PowerShell script.
  • .sh: Unix / Linux Bash shell script.
  • .vbs: Visual Basic Script.
• Office Productivity & Documents:
  • .docx, .xlsx, .pptx: Modern Microsoft Office Open XML documents, spreadsheets, and presentations.
  • .pdf: Adobe Portable Document Format (universal read-only document standard).
  • .txt: Unformatted plain text.
  • .rtf: Rich Text Format.
  • .csv: Comma-Separated Values (structured tabular data).
• Archives & Disk Images:
  • .zip: Standard compressed archive container.
  • .tar: Unix Tape Archive (bundles multiple files together without compression).
  • .gz: Archive compressed using the gzip algorithm (frequently paired with tar as .tar.gz or .tgz).
  • .7z: High-compression 7-Zip archive.
  • .iso: Sector-by-sector disk image of an optical disc (CD/DVD/Blu-ray) or OS installation media.

Exam Trap & Security Risk: By default, Microsoft Windows hides file extensions for known file types (e.g., displaying financial_report.pdf instead of financial_report.pdf.exe). Threat actors actively exploit this default setting through double-extension social engineering attacks. An attacker emails a malicious executable named invoice.pdf.exe with a customized Adobe Acrobat icon. Because Windows hides the final .exe extension, the unsuspecting user sees only invoice.pdf and executes malware. IT security policies mandate unchecking "Hide extensions for known file types" across all corporate endpoints.

---

Access Control, Permissions & Security Attributes

Operating systems protect confidential data and prevent system corruption by enforcing Access Control Models based on the Principle of Least Privilege: users and processes should be granted only the minimum permissions necessary to perform their legitimate business duties.

1. Windows NTFS Permissions

When a storage volume is formatted with NTFS, the operating system assigns a Security Descriptor to every file and folder, containing a Discretionary Access Control List (DACL) composed of multiple individual Access Control Entries (ACEs) mapping users or security groups to specific permissions.

Standard NTFS permission levels include:

• Full Control: Unrestricted power. Allows reading, writing, modifying, deleting, changing NTFS permissions, and taking file ownership.
• Modify: Allows reading, writing, executing, and deleting files and subfolders, but cannot change permissions or take ownership.
• Read & Execute: Allows viewing folder contents, reading file data, and executing program binaries.
• Read: Allows viewing file contents, folder contents, and metadata attributes in a read-only capacity.
• Write: Allows creating new files/folders, writing data streams, and appending data, but does not allow deleting existing files.

NTFS Permissions vs. Share Permissions

When folders are shared across a local network using the Server Message Block (SMB) protocol, two independent layers of security permissions are evaluated:

• Share Permissions: Applied strictly at the network share gateway (options: Read, Change, Full Control). Share permissions apply only to users connecting over the network.
• NTFS Permissions: Applied directly to the local storage file system. NTFS permissions apply both to users logging on locally and to users accessing the data across the network.

+-------------------------------------------------------------------------+
|                   NETWORK ACCESS PERMISSION FLOW                        |
|                                                                         |
|   [ Remote User over SMB ]                                              |
|             |                                                           |
|             v                                                           |
|   +---------------------------------------+                             |
|   | Layer 1: Network Share Permissions    |  (e.g., Full Control)       |
|   +---------------------------------------+                             |
|             |                                                           |
|             v                                                           |
|   +---------------------------------------+                             |
|   | Layer 2: Local NTFS File Permissions  |  (e.g., Read)               |
|   +---------------------------------------+                             |
|             |                                                           |
|             v                                                           |
|   =========================================                             |
|   EFFECTIVE PERMISSION = MOST RESTRICTIVE   --> Effective: READ ONLY    |
|   =========================================                             |
+-------------------------------------------------------------------------+

The Golden Effective Permission Rule: When a user accesses a folder across the network, the operating system evaluates both Share permissions and NTFS permissions. The user's effective permission is ALWAYS the MOST RESTRICTIVE permission between the two sets.

• Scenario: Share permission = Full Control; NTFS permission = Read. Effective network permission = Read.
• Scenario: Share permission = Read; NTFS permission = Full Control. Effective network permission = Read.

Permission Inheritance vs. Explicit Permissions

• Inherited Permissions: By default, any new file or subfolder created within a parent directory automatically inherits the NTFS permissions configured on that parent directory. Inheritance simplifies administration by ensuring consistent security policies across broad directory trees.
• Explicit Permissions: Permissions configured directly on a specific file or folder. Administrators can disable inheritance on a sensitive subfolder, choosing to either convert inherited permissions into explicit editable permissions or purge them entirely.
• Permission Precedence: In Windows, permissions are resolved according to strict priority:
  1. Explicit Deny (highest priority—overrides all other permissions)
  2. Explicit Allow
  3. Inherited Deny
  4. Inherited Allow (lowest priority)

Moving vs. Copying Files in NTFS

• Copying a File: When you copy a file (either within the same NTFS volume or to a different NTFS volume), it is treated as a brand new file creation. The new copy inherits the permissions of the target destination folder.
• Moving a File Within the Same NTFS Volume: The file's data blocks do not move on disk; only the directory pointers in the Master File Table are updated. The file retains its original permissions.
• Moving a File Across Different NTFS Volumes: The file must be physically written to the new volume and deleted from the old volume. The file inherits the permissions of the destination folder.

2. Linux / Unix Permission Model (RWX & Octals)

In Linux and Unix file systems, every file and directory maintains an access control mode string consisting of 10 characters (e.g., -rwxr-xr-x).

The first character identifies the file type (- for a regular file, d for a directory). The remaining 9 characters are divided into three groups of three, representing three distinct entities:

1. User / Owner (u): The individual account that owns the file.
2. Group (g): Members of the security group assigned to the file.
3. Others / World (o): All other user accounts on the system.

The Three Core Permission Attributes

• Read (r): Value = 4. On a file, allows viewing its text or binary content. On a directory, allows listing the names of files inside (ls).
• Write (w): Value = 2. On a file, allows modifying, writing, or truncating content. On a directory, allows creating, renaming, or deleting files within that directory.
• Execute (x): Value = 1. On a file, allows executing the file as a compiled program or shell script. On a directory, allows entering or traversing into the directory (cd).

Calculating Octal Values

By summing the numeric values of active permissions (4 + 2 + 1), each three-character group is converted into an octal digit (0 through 7):

• Read (4) + Write (2) + Execute (1) = 7
• Read (4) + Write (2) + No Execute (0) = 6
• Read (4) + No Write (0) + Execute (1) = 5
• Read (4) + No Write (0) + No Execute (0) = 4
• No Read (0) + No Write (0) + No Execute (0) = 0

PERMISSION MODE STRING: - r w x r - x r - x
                        | ----- ----- -----
                        |   |     |     |
                        |   |     |     +--> Others: Read (4) + Execute (1) = 5
                        |   |     +--------> Group:  Read (4) + Execute (1) = 5
                        |   +--------------> Owner:  Read (4) + Write (2) + Execute (1) = 7
                        +------------------> File Type: Regular File (-)
                        
OCTAL NOTATION: 755

• chmod 755 script.sh: Owner has full control (rwx = 7); Group and Others can read and execute but cannot modify (r-x = 5). Standard for executable scripts and binaries.
• chmod 644 document.txt: Owner can read and write (rw- = 6); Group and Others can only read (r-- = 4). Standard for general documents, configuration files, and web pages.
• chmod 700 private.key: Owner has complete access (rwx = 7); Group and Others have zero access (--- = 0). Standard for SSH private keys and confidential files.

Ownership Commands

• chmod (Change Mode): Modifies permission bits (e.g., chmod 755 file.sh or symbolic notation chmod +x script.sh).
• chown (Change Owner): Modifies the user and group ownership of a file (e.g., chown alex:developers report.txt).

---

Common Exam Traps & Real-World Pitfalls

• Trap 1: The FAT32 4 GB Individual File Trap. You have a 128 GB USB flash drive formatted with FAT32 containing 100 GB of free space. You attempt to download a 5.5 GB Windows 11 installation ISO image directly to the flash drive, and the transfer aborts with a "file too large" error. Novices assume the drive is full or failing. The reality is the absolute 4 GB single file limit of FAT32. Formatting the drive with exFAT or NTFS instantly resolves the problem.
• Trap 2: The Network Share Permission Conflict Trap. An exam question states: "A user has Full Control share permissions on a network folder, but Read permissions on the NTFS security tab. What can the user do over the network?" Always apply the most restrictive rule: the user has Read-Only access.
• Trap 3: Case-Sensitivity Scripting Bugs. A software developer authoring a web application on a Windows laptop references an image as <img src="Banner.PNG">. On Windows, the file loads perfectly even though the actual file on disk is named banner.png. When the developer deploys the website to a production Linux web server, the image breaks with a 404 Not Found error because Linux file systems (like ext4) are strictly case-sensitive.
• Trap 4: File Moving vs. Copying Permission Inheritance. Remember that copying an NTFS file to a new folder creates a new file that inherits the destination folder's permissions. Moving a file within the same NTFS volume retains its original permissions. Moving a file across volumes acts like a copy-and-delete, inheriting destination permissions.