The file system determines the format of your device and serves as the means for allocating, storing, and managing the data. File systems are responsible for the way in which your files are stored and manipulated at the lowest level. They depend on the operating system and are usually typical for certain storage devices.
Before you start data recovery, it’s advisable for you to know which file system is employed on your data storage medium to get a more profound understanding of how your files are actually stored and thus choose the proper data recovery software.
Storage devices
Although file systems are flexible in terms of which storage they work on, as a rule, you can still determine the file system type by a storage device.
USB flash drives and memory cards usually operate FAT or exFAT. This file system type is compatible with a variety of operating systems. This allows you to use your USB flash drive or a memory card with any computer.
NTFS, HFS+, Ext2-4 are very typical for personal computers and workstations. These file systems work in an isolated manner and are not compatible with their counterparts.
Most NAS storage are based on XFS, Ext2-4, Btrfs, or ReiserFS file systems. They are considered to be the most appropriate for home servers due to their design, while XFS, for instance, is a perfect choice for medium and large files and, finally, ReiserFS gives maximum speed. File systems on NAS devices are normally hidden and are shown as network folders via special network protocols.
Operating systems
It is usually difficult to determine the file system relying on the storage type only, hence, the operating system can give you the clue. The file system is related to the operating system installed onto the storage, but as different file systems normally serve different purposes, there are sometimes several file system options for one operating system.
Windows OS
NTFS
NTFS is the most popular and widespread file system for the Windows family of operating systems. This is the default file system for Windows disks and disk partitions. The file system can be easily extended and supports many file properties, including access control, encryption, etc. One of the drawbacks of this file system is a rather complicated method of storing data.
Structure: the file system header (the boot record), the Master File Table ($MFT), space for files.
The NTFS file system uses the Master File Table (MFT) for coordinating files. Basically, the MFT contains information about all files and folders holding these files. This information, to be specific, includes the location, name, size of a file as well as the date and time of its creation, and last modification.
If the attributes of a file are too big for one MFT cell to hold them, the file system will allocate another cell placed in a file for the list of file attributes.
File deletion
Procedure: the file system does not delete and rather labels the file record in the MFT as unused and marks the file location in the MFT and Bitmap as released. The system also deletes the file entry from its directory.
Recovery: the information about the deleted file (name, size, location) remains in the MFT. If the MFT record remains unchanged and the disk data is not overwritten, the recovery chances of this file are 100%. Yet, if this record is deleted, it is still possible to find the file by its content with the help of the raw recovery method. The recovery procedure is then performed by disk contents bypassing the file system structure).
Formatting
Procedure: the file system wipes only the beginning of the MFT. The MFT tail remains unchanged.
Recovery: the first 256 files lose their links to the MFT; thus, their recovery is only possible with the raw recovery method. The recovery chances for the files that follow these 256 files are up to 100%.
FAT/FAT32
FAT/FAT32 is one of the oldest file systems with a very simple design. This file system is supported by all operating systems making free data exchange between different storage possible. This file system is applied on small external data storage devices such as memory cards of photo- and video cameras and USB flash drives.
The most obvious drawback of this system is its inability to store large files – the restrictions on the size of each file are 2 GB for FAT16 and 4 GB for FAT32.
Structure: the file system header (2 headers more for FAT32), FAT tables, and the data area.
The FAT file system applies the File Allocation Table containing an entry for each cluster on the disk and makes a link from this table to the file location on the disk. It also holds links to the cluster of the file start, file continuation, and file end. The FAT file system does not apply defragmentation of fragmented files. Due to the system’s original design, the files on FAT have 8 symbols for the file name and 3 symbols for the file extension. That is why the file system stores long file names separately utilizing the long file names (LFN) extension feature.
File deletion/Formatting
Procedure: the file system deletes all the information contained in the File Allocation Table including the links to the file continuation and end cluster. The data area itself is not wiped, though. The first symbol of the file name is deleted in its short form, and in the case of FAT 32, the part of information about the starting file cluster is deleted.
Recovery: the file start can be found, but the information about the file continuation and the end needs an assumption. For this reason, data recovery may be incomplete. Besides, the FAT file system doesn’t defragment files making it difficult to retrieve fragmented files even with the help of the raw recovery method. Another issue is that file names are limited in length and can even be stored detached on the disk. Recovering long file names may give no results.
ExFAT
ExFAT was developed by Microsoft Corporation in order to extend FAT. The simplicity of this file system has made it quite popular. But unlike its predecessor, ExFAT is capable of storing files of any size.
Structure: the file system header, the FAT table, and the data area.
Like its predecessors, the ExFAT file system applies the File Allocation Table to manage files. This table contains an entry for each cluster on the disk and makes a link from this table to the file location on the disk. It also holds links to the file start, file continuation, and file end. This file system tries to avoid file fragmentation and does not provide linking to file sub-directories.
File deletion/Formatting
Procedure: the file system deletes all the information contained in the File Allocation Table including the links to the file continuation and end. The data area itself is not wiped, though.
Recovery: as links to files continuation may be lost, the recovery result for files with the size of several blocks can be incomplete. The chances for successful recovery of a file in case of directory damage can be low as well. At the same time, recovery of files by their contents (the raw recovery method) may give highly positive results due to low file fragmentation.
ReFS
ReFS is a file system that is frequently implemented in servers. This file system applies Copy-on-Write (COW) enabling the older versions of deleted files to still remain on the disk. This file system is not the best choice to store plain user files, as it allocates a minimum of 64 KB of disk space for each file. If the file is less than 64 KB in size, the file system will in any case save it to that place, thus making the use of the disk space inefficient.
macOS
HFS
The HFS file system is presently a legacy Mac file system supported by Recovery Nerd Tech Solutions in the read-only mode (no scanning).
HFS+
HFS+ is a journaling file system that makes easy data retrieval after logical failures possible. The system stores large file names in the Unicode. Its major disadvantage is problems in working with fragmented files.
Structure: the file system header; the file system journal; the Catalog File with the files containing information about other files (the so-called hard-link files).
The HFS+ file system supports journaling. The file system journal keeps track of all file system modifications. The HFS+ journal is limited in its size, the new information is added and written over the old journal records. In this way, the file system overwrites the older information to release the journal for data about newer file system modifications.
The HFS+ file system aims at files defragmentation. The file system thoroughly looks for a place to store files and matches file fragments together. Yet, the remaining fragmented files can impede getting the best recovery result.
HFS+ supports hard links which are stored as separate files inside the hidden HFS+ root directory and serve to store information about user files. Each hard-link file is bound to its user file.
File deletion
Procedure: the file system deletes a hard link from the directory. Nevertheless, it still keeps this information in its journal records for some time.
Recovery: the program can address the file system journal to find an older file system state and return the lost hard link to its initial place. Data recovery chances will depend greatly on how long the system has been used after the file deletion. Yet, if the journal record has been emptied, you can try the raw recovery method, which can give excellent results for non-fragmented files.
Formatting
Procedure: the file system deletes the hard-link directory leaving the journal and the on-disk data area intact.
Recovery: the program addresses the file system journal to recover everything that is recoverable from the journal or employs raw recovery (by the file contents) to retrieve the lost files. The recovery chances may be low for fragmented files due to hard-links deletion.
Linux
Linux has a handful of file systems to meet the user’s every need. However, each of them has its own advantages and disadvantages.
Ext2-Ext4
Ext2-Ext4 file systems are mostly the default systems for Linux. These systems feature high speed, efficiency, and adjustability to different purposes of system activities. Their main disadvantage is that they require too much disk space for system structures.
Structure: the file system header; inodes; an inode table.
Ext2
The Ext2 file system uses inodes containing information about files. This information includes the user and group ownership, access mode, and extension. Some inodes include a copy of the inode table.
Inodes do not include file contents and file names, as they are stored in file directories and are not considered to be metadata according to the file system.
File deletion
Procedure: Ext2 labels the file inode as free and updates the map of free blocks. The filename entry is unlinked from the directory record. The filename to node reference is wiped. The file will be deleted as soon as all inode references to this file are deleted.
Recovery: due to the fact that the file descriptions remain in the inode, the chances to retrieve the file are quite high. Nevertheless, file names stored in directories and unlinked from the file will be lost.
Formatting
Procedure: Ext2 wipes all the file allocation groups and deletes the file inodes.
Recovery: the program can apply the raw recovery method to find the files by their contents. Recovery chances depend on the extent of file fragmentation: fragmented files are hard to retrieve.
Ext3/Ext4
Structure: the file system header; an inode; an inode table.
In addition to inodes implemented in the Ext2 file system, Ext3, and Ext4 use file system journaling. The file system journal keeps track of all modifications made by the file system. Ext4 differs from the Ext3 file system in the structure of the reference.
File deletion
Procedure: The file system makes an entry to the journal and then wipes the file inode entry. The directory record is not deleted completely and rather the order for directory reading is changed.
Recovery: the retrieval of deleted files even with the file name is possible owing to the file system journal. Still, the recovery result depends on how long the file system remains in operation after file deletion.
Formatting
Procedure: All allocation groups, as well as file nodes and the journal, are wiped. The file system journal may still contain information about some of the recently created files.
Recovery: the retrieval of lost files is only possible with the raw recovery method which helps to find the lost files by their contents. Fragmented files have low recovery chances.
ReiserFS
ReiserFS is a private project that was developed to enable the user to efficiently store a large number of small files. This file system has high-speed performance. However, ReiserFS is no longer actively supported for some technical reasons.
Structure: the file system header, the S+tree.
The file system uses the S+-tree which stores the file’s metadata and has descriptors of all files and file fragments. In the process of writing new metadata into the tree, a new tree created for the new data replaces the old one. At the same time, its older copy remains on the disk. Thus, the file system can store lots of metadata copies. This technique is called Copy-on-Write (COW).
File deletion
Procedure: The system updates its S+-tree to exclude a file and renews the map of free space.
Recovery: due to COW, it is possible to recover all files including their names. Moreover, you can also retrieve the previous version of a file from an older S+-tree copy.
Formatting
Procedure: The file system creates a new S+-tree over the existing one.
Recovery: COW helps to retrieve the previous file system state making total data recovery possible. However, the chances for complete recovery of lost files are lower if the file system partition was full. In such a case, the system would overwrite the old data with a new one.
XFS
XFS was developed by Silicon Graphics for their IRIX servers. The strong point of this file system is its capability to work with files of any size. The file system has a high level of files optimization but is based on a complex file system structure. Several versions of XFS exist, such as Trix Intel for Windows. Recovery Nerd Tech Solutions supports all XFS versions. XFS can be employed in all the variants of Linux distributions.
Structure: complex tree structures, inodes, bitmaps
The XFS file system uses inodes to store the file’s metadata and journaling to keep track of system modifications. Only metadata is journaled with this file system. Each inode has a header and a bitmap. XFS stores inodes in a special tree in a specific place on the disk. The system also has a bitmap for free storage blocks.
File deletion
Procedure: the inode responsible for this file is excluded from the tree; its place is overwritten with new information.
Recovery: XFS keeps the file metadata enabling the recovery of lost files. The chances to recover a deleted file even with a correct file name are quite high.
Formatting
Procedure: the root directories of the file system are overwritten.
Recovery: the chances to recover the files which were not at the beginning of the storage are high in contrast to the files which were close to the disk starts.
JFS
The JFS file system was developed by the IBM Company for its internal servers. This is a journaling file system of Linux OS. This file system features reliability and high productivity. JFS can be even called the second after the XFS file system, but it has a more complicated architecture. Presently JFS is used in corporate Linux systems.
Structure: the superblock, the B+-tree, the journal, i-node file sets
The JFS file system employs the B+-tree structure for storing data, journaling for file system modifications, and inodes to describe files. The system is also capable of storing several file systems on one partition with links to the same file. File names can be saved in the Unicode and UTF8 encodings.
File deletion
Procedure: JFS updates the counter of object uses and releases its inode in the inodes map. The directory is rebuilt to reflect the changes.
Recovery: The file inode remains on the disk increasing the chances of files recovery up to almost 100%. The recovery chances are low for file names only.
Formatting
Procedure: JFS writes a new tree. It is initially small and gets extended with further file system use.
Recovery: the chances to recover the lost files after formatting is quite high due to the small size of the new B+-tree. Moreover, the internal inodes numbering increases the chances for an easy files recovery after formatting.
