File Systems, Storage Management and Data Recovery

Introduction

Business information exists as files: invoices, customer records, spreadsheets, contracts, databases, emails, images and transaction logs. Although users often experience information through applications, the operating system must organize that information on storage devices, control access to it, allocate physical space and support recovery when hardware, software or human actions cause loss. File systems and storage management therefore form an essential bridge between computer hardware, operating-system services and business continuity.

A useful distinction is between storage media, storage devices and file systems. Magnetic disks, solid-state drives and removable media are storage media. A hard-disk drive or SSD is a storage device that presents storage capacity to a computer. A file system is the operating-system structure that names files, records their locations and attributes, manages free space, and enforces access rules. Without a file system, a disk would be a sequence of blocks rather than an intelligible collection of business documents.

Learning Objectives

After completing this chapter, you should be able to:

• explain files, metadata, directories, paths, partitions and permissions;
• compare common file systems and select them for appropriate uses;
• describe storage allocation, disk scheduling and performance measures;
• explain redundancy, backup strategies and data-recovery procedures;
• organize and protect business information using sound operational practices;
• evaluate the governance, security and continuity implications of storage decisions.

1. Files and File-System Organization

1.1 What is a file?

A file is a named collection of related data stored as a logical unit. The data may be human-readable text, structured records, program instructions, audio, video or binary information. The operating system usually treats a file as a sequence of bytes, while an application interprets those bytes according to a format such as PDF, JPEG, CSV or a database format.

A file has both content and metadata. Metadata describes the file rather than constituting its ordinary content. Typical metadata includes:

• file name and extension;
• size in bytes;
• owner and group;
• creation, modification and access times;
• file type;
• permissions and access-control information;
• physical allocation information;
• integrity information such as a checksum.

The extension is useful to people and applications, but it is not a complete guarantee of file type. An operating system may also inspect file signatures or rely on application registration. Renaming a file from report.txt to report.jpg does not convert its contents.

Files may be accessed sequentially or directly. In sequential access, data is read in order, which is suitable for streaming a log. In direct or random access, an application can move to a particular logical location, which is important for databases and indexed files.

1.2 Directories, folders and paths

A directory (often called a folder) is a file-system structure that associates names with files and sometimes with other directories. Directories create a hierarchy. A typical business structure might be:

Company/
├── Finance/
│   ├── 2025/
│   └── Budgets/
├── Human-Resources/
└── Sales/
    ├── Customers/
    └── Reports/

A path identifies the location of an object in this hierarchy. An absolute path begins at the root of a file system, such as /srv/company/finance/2025/budget.xlsx in a Unix-like system or C:\Company\Finance\2025\budget.xlsx in Windows. A relative path is interpreted from the current directory, such as 2025/budget.xlsx.

Directories improve findability, delegation and backup selection, but poor design produces duplicate, ambiguous or abandoned information. A practical naming convention uses meaningful names, dates in a consistent order such as YYYY-MM-DD, and version or status indicators where needed. Names should avoid unexplained abbreviations and characters that cause problems across operating systems.

A directory entry may refer to a file through a hard link, while a symbolic link stores a path to another object. Hard links can complicate deletion and backup interpretation; symbolic links can become invalid when the target is moved. These features should therefore be governed in shared business environments.

1.3 File allocation and free space

The storage device is divided into fixed-size units commonly called blocks or clusters. The file system records which blocks belong to each file and which remain free. A file may occupy contiguous blocks, linked blocks or an indexed collection of blocks. Contiguous allocation can provide fast sequential access, but expanding a file may require relocation. Indexed and extent-based methods offer greater flexibility; an extent is a contiguous range of blocks assigned to a file.

Fragmentation occurs when a file's blocks are scattered. External fragmentation refers to separated free areas that are individually too small for convenient allocation. File systems and storage devices use allocation strategies, extents, free-space maps and sometimes defragmentation to reduce performance effects. Traditional hard disks can benefit from defragmentation, whereas routine defragmentation is generally inappropriate for SSDs because it adds writes without providing the same mechanical benefit. SSDs use flash-management techniques such as wear leveling and garbage collection internally.

File-system journaling records intended metadata changes before applying them fully. After a crash, the journal can help restore structural consistency. Journaling does not automatically preserve every recent file-content change and is not a substitute for backup.

2. Permissions and Access Control

Permissions determine who may read, modify, execute or administer a file. In a simple Unix-like model, rights are assigned to the owner, a group and other users. The familiar permissions are:

• read: inspect file contents or list a directory, subject to system rules;
• write: change file contents or create/delete directory entries;
• execute: run a program, or traverse a directory when applied to a directory.

Windows commonly uses access-control lists (ACLs), in which multiple users and groups receive allow or deny entries. Enterprise systems may also apply role-based access control, where permissions follow job roles rather than individual ad hoc assignments.

The principle of least privilege states that a user or process should receive only the access required for its legitimate task. A payroll clerk may need to read payroll data and update a specified workflow, but should not automatically receive unrestricted access to customer passwords or system configuration. Least privilege reduces accidental disclosure and limits the damage caused by compromised accounts.

Important practices include:

1. assign access through groups and roles rather than individually whenever possible;
2. separate ordinary user accounts from administrative accounts;
3. review permissions periodically and remove access when employment or duties change;
4. use separation of duties for sensitive actions, such as creating and approving a payment;
5. protect backups with access controls at least as strong as those on production data;
6. log access to confidential records and investigate unusual activity.

Permissions are not identical to encryption. Permissions control authorized operating-system access; encryption transforms data so that possession of the storage medium does not necessarily reveal its contents. Sensitive laptops, portable drives and backups should use encryption, while keys must be managed separately and securely.

3. Partitions, Volumes and Common File Systems

3.1 Partitions and volumes

A partition is a logically defined region of a physical storage device. A partition table records boundaries and types. A volume is a usable logical storage area, often created from a partition but also potentially provided by a volume manager, storage array or network service. A volume is normally formatted with a file system before users store files on it.

Partitioning can separate an operating system from user data, support multiple operating systems, establish recovery areas and simplify capacity management. However, partitions do not constitute backup: damage to the physical disk can affect every partition. Excessive partitioning can also strand free space in one partition while another becomes full.

Modern systems commonly use GPT (GUID Partition Table), which supports large disks and many partitions, while older systems may use MBR (Master Boot Record), which has more restrictive design limits. The choice depends on firmware, operating-system compatibility and organizational requirements.

3.2 Common file systems

The best file system depends on the operating system, device, file sizes, access-control requirements, resilience needs and interoperability. Compatibility alone should not determine the choice for sensitive business data. An exchange drive formatted as exFAT may be convenient, but confidential contents still require encryption and controlled handling.

A file system can become corrupted when its metadata no longer accurately describes storage allocation, perhaps because of power loss, failing hardware or software defects. File-system checking tools can identify and repair some structural errors, but repair may delete damaged references or produce recovered fragments. Important evidence should be imaged or preserved before aggressive repair, especially in legal or forensic situations.

4. Storage Management and Performance

Storage management concerns capacity, allocation, availability, performance, protection and lifecycle. A business must ask not merely “How much storage is available?” but also “How quickly must data be accessed, how long must it be retained, who may access it, and how will it be recovered?”

4.1 Capacity and performance measures

Common measures include:

• capacity: the amount of data that can be stored;
• throughput: data transferred per unit of time, often MB/s or GB/s;
• IOPS: input/output operations per second;
• latency: delay before an operation completes;
• availability: the proportion of required time a service is usable.

For a storage workload, a simple average throughput relationship is:

The units must be consistent. If 600 GB is transferred in 120 seconds, the average throughput is 5 GB/s. This is an average measurement, not a guarantee for every operation. Small random requests may have much lower throughput than large sequential transfers.

For a rotating disk, access time is commonly understood as the sum of seek time, rotational latency and transfer time. If the disk rotates at R revolutions per minute, the time for one full rotation is:

Under the assumption that a request arrives at a random angular position, average rotational latency is approximately half a rotation:

For a 7,200-RPM disk, this is 30 ÷ 7,200 seconds, or approximately 4.17 milliseconds. This approximation applies to rotating media and excludes seek and transfer time. SSDs have no rotating latency, although controller, flash and queueing delays remain.

4.2 Disk scheduling

When several disk requests are waiting, the operating system or controller may choose their order. Scheduling is especially important for mechanical disks because moving the read/write head costs time.

• FCFS (First-Come, First-Served) processes requests in arrival order. It is simple and fair in arrival terms but may cause large head movement.
• SSTF (Shortest Seek Time First) selects the request nearest the current head position. It often reduces immediate movement but can starve distant requests.
• SCAN, or the elevator algorithm, moves in one direction servicing requests, then reverses direction. It provides more predictable waiting than SSTF.
• C-SCAN services requests in one direction and, on reaching the end, returns to the beginning without servicing requests during the return. It can give more uniform waiting times.

Consider a disk with tracks numbered 0–199, an initial head position of 50, and pending requests 82, 170, 43, 140, 24, 16 and 190. Under FCFS, the head movement is:

|50−82| + |82−170| + |170−43| + |43−140| + |140−24| + |24−16| + |16−190|
= 32 + 88 + 127 + 97 + 116 + 8 + 174 = 642 tracks

This illustrates why arrival order may be inefficient. An actual operating system may use more sophisticated, workload-aware policies, and SSDs generally require different scheduling priorities because seek movement is not relevant.

5. Redundancy and Storage Reliability

Redundancy means keeping additional components or copies so that failure of one element does not immediately destroy service or data. Redundancy can address availability, performance or recoverability, but it does not eliminate the need for backups.

RAID (Redundant Array of Independent Disks) combines drives using different arrangements:

RAID improves resilience against specified drive failures, but RAID 0 is not redundant and every RAID level can be affected by controller failure, malware, fire, theft, file deletion or a site-wide incident. A synchronized deletion can also be replicated across an array. Thus, the operational rule is: RAID is not backup.

Other forms of redundancy include replicated servers, geographically separate copies, spare power supplies and alternative network paths. Redundancy should be matched to business impact. A small local file server may need mirrored disks and tested backup; a payment platform may additionally require replicated storage, failover infrastructure and a documented continuity plan.

6. Backup and Data Recovery

A backup is a separate copy of data maintained so that the original can be restored after loss or corruption. Backup planning begins with two business objectives:

• Recovery Point Objective (RPO): the maximum acceptable amount of data loss measured in time. An RPO of four hours means the organization can tolerate losing up to four hours of changes.
• Recovery Time Objective (RTO): the maximum acceptable time to restore a service or data set after disruption.

Backup types include:

• full backup: copies all selected data;
• incremental backup: copies changes since the most recent backup of any type;
• differential backup: copies changes since the most recent full backup;
• snapshot: a point-in-time representation, often efficient because unchanged blocks are shared;
• continuous or near-continuous protection: records changes frequently or continuously.

Suppose a full backup is made on Sunday, incremental backups on Monday through Thursday, and a failure occurs on Thursday night. Restoring requires the Sunday full backup plus Monday, Tuesday, Wednesday and Thursday incrementals. With a differential schedule, Thursday's differential contains all changes since Sunday, so restoration requires the Sunday full backup and Thursday differential, although daily differentials become larger.

The 3-2-1 rule recommends keeping at least three copies of important data, on at least two different media or storage types, with at least one copy off-site. Modern practice often strengthens this with an offline or immutable copy to resist ransomware. “Off-site” should be meaningful: a second room in the same building may not protect against fire or flood.

Backups must be protected from unauthorized access, encryption keys must be recoverable under controlled procedures, and retention must reflect legal, contractual and operational requirements. Keeping every copy forever increases cost and may conflict with privacy or data-minimization obligations. A retention schedule should specify what is retained, for how long, by whom and when it is securely disposed of.

Recovery process

A disciplined recovery process generally follows these stages:

1. Identify and contain the incident. Prevent further overwriting, isolate malware and preserve evidence where necessary.
2. Assess scope and priority. Determine affected systems, data criticality, RPO and RTO.
3. Select a trustworthy recovery point. Verify that the backup predates corruption or compromise.
4. Restore to a controlled environment. Do not immediately overwrite the only original or reconnect an infected system.
5. Validate. Check file integrity, application consistency, permissions, transactions and user acceptance.
6. Return to service gradually. Monitor systems and maintain a record of actions.
7. Review and improve. Identify the root cause and update controls.

Recovery is not merely copying files. A database may require transaction-log replay; an application may depend on configuration, identity services and encryption keys; a restored file may be technically intact but unusable if its permissions or relationships are wrong.

Integrity can be checked with a cryptographic hash. If a file produces digest h₁ before transfer and h₂ after transfer, matching values provide strong evidence that the contents are unchanged, assuming a trustworthy hash function and process. A hash does not encrypt data and does not prove that the file is authentic unless the reference hash itself is protected.

7. Applied Case: Recovery of a Retail Company’s Shared Drive

Background

This illustrative case concerns Northstar Retail, a medium-sized business using a Windows file server for purchasing, finance and sales documents. The server used mirrored disks, daily snapshots and a weekly cloud backup. Permissions had accumulated over several years, and former employees remained in some shared groups.

Problem

A staff member opened a malicious attachment. Several shared folders were encrypted by ransomware, including files created during the previous afternoon. The attacker also attempted to delete accessible snapshots. The mirrored disks continued operating, but the data was unusable.

Analysis

The mirror provided availability against a disk failure but did not protect against malicious modification. The most recent cloud backup was two days old, creating a potential RPO of approximately two days. The incident team also had to determine whether confidential customer information had been accessed.

Approach and solution

The company disconnected affected systems, disabled compromised credentials and preserved logs. It selected an older immutable cloud backup, restored it to an isolated environment and verified file hashes, folder structure and permissions. Database exports were checked against transaction records. The restored service was first opened to a small group of users, then returned to general operation.

After recovery, Northstar introduced phishing-resistant authentication for administrators, quarterly permission reviews, separate backup credentials, immutable daily backup copies and monthly restoration tests. It also redesigned folders around departments and retention categories, rather than individual employees.

Outcome and learning points

Operations resumed with a controlled loss of recent documents, which were reconstructed from email and local working copies. The case demonstrates that RAID is not backup, snapshots can be vulnerable, identity security is part of recovery, and recovery objectives must be tested rather than assumed. It also shows why business information management combines technical controls with governance and user training.

8. Governance, Ethics and Contemporary Practice

Storage decisions affect privacy, accountability and legal compliance. Organizations should classify information according to sensitivity, define lawful retention requirements and restrict access to legitimate purposes. Personal data should not be copied casually to removable drives or consumer cloud accounts. When data is stored across borders, contractual and regulatory obligations may apply.

Logs and recovery images can contain confidential information. They should be access-controlled, retained only as necessary and handled according to evidence-preservation rules during investigations. Automated tools and AI-assisted classification can help identify duplicate files, sensitive information and anomalous access, but results require human review. Incorrect classification may expose data or cause essential records to be deleted.

Cloud storage changes the location of infrastructure, not the organization’s responsibility. Contracts should address availability, backup scope, data location, breach notification, portability, deletion and provider exit. A cloud synchronization folder is not automatically a backup: accidental deletion or ransomware may synchronize to every copy unless versioning, immutable backups or independent backup systems are used.

Best-practice checklist

• Establish an information classification and retention policy.
• Use clear directory structures and controlled naming conventions.
• Apply least privilege, group-based access and periodic reviews.
• Separate production, backup and administrative credentials.
• Monitor capacity, performance, failures and unusual access.
• Use encryption for sensitive data at rest and in transit.
• Maintain tested backups using the 3-2-1 principle and, where appropriate, immutable or offline copies.
• Define RPO and RTO for important services.
• Test complete restoration, including applications, permissions and keys.
• Document incidents and improve controls after every recovery exercise.

Chapter Summary

Files are logical collections of data described by metadata and organized through hierarchical directories and paths. File systems allocate blocks, maintain free-space information, enforce permissions and may use journaling to improve structural recovery. Partitions divide physical storage into logical regions, while volumes provide usable storage areas; neither replaces backup.

Common file systems differ in compatibility, permissions, scalability, journaling and platform integration. Storage management considers capacity, throughput, latency, IOPS, fragmentation and the distinct behavior of hard disks and SSDs. Disk-scheduling algorithms such as FCFS, SSTF, SCAN and C-SCAN seek to improve request handling, especially on mechanical disks.

Redundancy, including RAID, can maintain service during specified hardware failures but cannot protect against deletion, malware or site disasters. Backups, retention policies, RPO, RTO and tested recovery procedures provide broader protection. Effective business practice combines technical design with least privilege, encryption, governance, privacy, monitoring and regular restoration tests.

Key Terms

File: A named logical collection of data stored as a unit.

Metadata: Descriptive information about a file, such as size, owner and timestamps.

Directory: A structure that organizes file and directory names hierarchically.

Path: A description of an object’s location in a file-system hierarchy.

Partition: A logically defined region of a physical storage device.

Volume: A usable logical storage area presented for formatting and use.

File system: Structures and rules used to name, allocate, protect and retrieve files.

Permission: An authorization to perform an operation on a file or directory.

Least privilege: Granting only the access required for a legitimate task.

ACL: An access-control list specifying permissions for users or groups.

Fragmentation: Scattering of file blocks or free space in ways that may reduce efficiency.

Journaling: Recording intended file-system changes to assist structural recovery.

Throughput: Amount of data transferred per unit of time.

Latency: Delay between requesting and completing an operation.

Disk scheduling: Selecting the order in which pending storage requests are served.

RAID: Combining storage devices to provide performance, capacity or redundancy.

Backup: A separate recoverable copy of data.

RPO: Maximum acceptable data loss expressed as a time interval.

RTO: Maximum acceptable time to restore a service or data set.

Snapshot: A point-in-time representation of data or a volume.

Review Questions

Short Answer Questions

1. Distinguish file content from file metadata.
2. What is the principle of least privilege?
3. Explain the difference between a partition and a volume.
4. Why is RAID not a substitute for backup?
5. Define RPO and RTO.

Long Answer Questions

1. Explain how directories, paths, naming conventions and permissions support business information management.
2. Compare NTFS, exFAT, ext4 and APFS in terms of likely uses and limitations.
3. Describe FCFS, SSTF, SCAN and C-SCAN disk scheduling and explain why SSDs change the importance of seek optimization.
4. Compare full, incremental, differential and snapshot-based backup approaches.
5. Develop a storage and recovery policy for a medium-sized organization handling confidential customer data.

Analytical / Application Questions

1. A company stores its only database copy on a RAID 1 server and experiences ransomware encryption. Analyze why the mirror does not ensure recovery and propose a layered protection plan.
2. A disk receives requests at tracks 20, 90, 35, 140 and 10, starting at track 50. Calculate the FCFS head movement and explain one limitation of using this policy.
3. A business can tolerate at most one hour of lost transactions and requires service restoration within four hours. Design an appropriate backup and recovery approach, identifying the required RPO and RTO and explaining how you would test them.

Multiple Choice Questions with Answers

Question 1

Which item is an example of file metadata?

A. The words in a contract

B. The file’s modification time

C. A photograph’s pixel data

D. The rows in a spreadsheet

Correct Answer: B. The file’s modification time

Question 2

What does the principle of least privilege require?

A. All employees receive administrator access

B. Users receive only the access needed for legitimate tasks

C. Backups are stored on the same disk as production data

D. Every file is publicly readable

Correct Answer: B. Users receive only the access needed for legitimate tasks

Question 3

Which statement correctly describes a partition?

A. A logical region of a physical storage device

B. A type of file permission

C. A copy of a file stored off-site

D. A disk-scheduling algorithm

Correct Answer: A. A logical region of a physical storage device

Question 4

Which file system is commonly associated with modern Linux installations?

A. ext4

B. FAT12

C. NTFS only

D. UDF only

Correct Answer: A. ext4

Question 5

What is the principal weakness of RAID 0?

A. It cannot improve performance

B. It requires two copies of every file

C. It provides no fault tolerance

D. It works only with optical disks

Correct Answer: C. It provides no fault tolerance

Question 6

Under the 3-2-1 backup rule, what does the '1' generally represent?

A. One file format

B. One off-site or otherwise isolated copy

C. One administrator password

D. One partition per disk

Correct Answer: B. One off-site or otherwise isolated copy

Question 7

Which backup type copies changes since the most recent full backup?

A. Differential backup

B. Incremental backup

C. Mirror-only backup

D. FCFS backup

Correct Answer: A. Differential backup

Question 8

A 7,200-RPM disk has an approximate average rotational latency of:

A. 0.42 milliseconds

B. 4.17 milliseconds

C. 41.7 milliseconds

D. 720 milliseconds

Correct Answer: B. 4.17 milliseconds

Question 9

What does RPO measure?

A. The maximum acceptable restoration time

B. The maximum acceptable amount of data loss in time terms

C. The number of redundant disks

D. The average disk throughput

Correct Answer: B. The maximum acceptable amount of data loss in time terms

Question 10

Why should a restored backup be validated before returning a system to service?

A. To ensure data, permissions and application consistency

B. To increase the disk’s rotational speed

C. To convert every file to the same format

D. To eliminate the need for access controls

Correct Answer: A. To ensure data, permissions and application consistency