File Systems: ext4, NTFS, and ZFS

File systems are the backbone of data storage — they determine how data is structured, accessed, and protected on disk. Three of the most widely used file systems today are ext4, NTFS, and ZFS, each optimized for different environments and use cases.

ext4 — The Linux Standard

The fourth extended file system (ext4) has been the default for most Linux distributions since 2008, succeeding ext3. It supports volumes up to 50 TiB and individual files up to 16 TiB, making it suitable for everything from embedded systems to large servers. Key features include:

• Extents: Instead of block-by-block mappings, ext4 stores contiguous block ranges (extents) in the inode, reducing fragmentation and improving large-file performance.
• Journaling: Metadata changes are written to a journal before the main file system is updated, ensuring crash recovery without a full fsck.
• Delayed allocation: Blocks are allocated when data is flushed to disk rather than when write() is called, allowing the allocator to make better contiguous placement decisions.
• Flexible block groups: Block groups are merged into flex_bg groups to reduce metadata fragmentation.

# Create and tune an ext4 file system
mkfs.ext4 -b 4096 -O extent,flex_bg /dev/sda1
tune2fs -c 30 -i 90d /dev/sda1  # fsck every 30 mounts or 90 days

# Mount with performance options
mount -o noatime,nodiratime,data=ordered /dev/sda1 /mnt/data

# Check file system
dumpe2fs -h /dev/sda1 | grep -E 'Block count|Block size|Inode count'

Ext4 is reliable, mature, and works well for general-purpose servers and desktops. Its main limitation is the lack of built-in data checksumming, compression, or snapshots — features that require higher-tier file systems.

NTFS — The Windows Primary

NTFS (New Technology File System) replaced FAT32 starting with Windows NT 3.1 in 1993. It supports volumes up to 256 TiB and files up to 256 TiB, with a rich feature set tailored for enterprise Windows environments:

• Master File Table (MFT): All file metadata is stored in a relational database-like structure. Small files (under ~1 KiB) can be stored directly in the MFT record (resident data), avoiding a separate cluster allocation.
• Access Control Lists (ACLs): Fine-grained permissions at the file and directory level, supporting inheritance and audit logging.
• Encrypting File System (EFS): Per-file transparent encryption using public-key cryptography, integrated with Active Directory.
• Journaling ($LogFile): NTFS logs metadata changes to ensure consistency after crashes or power failures.
• Alternate data streams (ADS): Multiple data streams can be attached to a single file, used by macOS resource forks and Zone.Identifier for downloaded-file security.
• Hard links, junctions, and symbolic links: NTFS supports multiple path-based references to the same file or directory.

# NTFS operations from Linux (ntfs-3g)
mount -t ntfs-3g -o uid=1000,gid=1000,windows_names /dev/sdb1 /mnt/windows

# Read MFT info
ntfsinfo -m /dev/sdb1 | head -20

# List alternate data streams
ntfsstreams /mnt/windows/Users/jane/report.docx

# Windows-side commands (PowerShell)
fsutil volume diskfree C:
fsutil behavior query encrypt
chkdsk C: /scan

ZFS — Enterprise-Grade Storage

ZFS originated at Sun Microsystems in 2005 and is now maintained as OpenZFS on Linux, FreeBSD, and Illumos. It is both a file system and a volume manager — you create a pool of physical disks and then create datasets (file systems) within that pool. ZFS’s headline feature is data integrity: every block is checksummed, and the checksum is stored separately from the data (in the parent block pointer), creating a Merkle tree of all data.

• Copy-on-write (CoW): ZFS never overwrites data in place. When a block is modified, it is written to a new location and the metadata tree is updated atomically. This prevents corruption from crashes and enables instant snapshots.
• Snapshots and clones: A snapshot captures the state of a dataset at a point in time — zero cost initially, consuming space only as data changes. Clones are writable snapshots.
• Compression: Built-in lz4, zstd, gzip, and lzjb compression. lz4 is nearly free in CPU cost and often improves throughput by reducing I/O.
• RAID-Z: Software RAID levels 1, 5, 6, and striped mirrors without the RAID-5 write hole (thanks to CoW and full-stripe writes).
• Deduplication: Block-level dedup using hash tables — powerful but memory-intensive (about 5 GiB RAM per TiB of unique data).
• Scrubbing: Periodic reads verify all checksums and repair any data that has become corrupt (bit rot detection).

# Create a ZFS pool with mirror vdevs
zpool create tank mirror /dev/sdb /dev/sdc
zpool add tank mirror /dev/sdd /dev/sde

# Create datasets with compression and quota
zfs create tank/projects
zfs set compression=lz4 tank/projects
zfs set quota=500G tank/projects
zfs set atime=off tank/projects

# Take and manage snapshots
zfs snapshot tank/projects@2026-07-08
zfs destroy tank/projects@old-snapshot

# Send/receive snapshot for backup
zfs send tank/projects@2026-07-08 | ssh backup-server zfs recv backup/projects

# Check pool health
zpool status -v
zpool iostat -v 5

# Simulate and verify checksum protection
zpool scrub tank
zpool status -v  # shows any checksum errors

Choosing the Right File System

Use ext4 for Linux boot partitions, general-purpose servers, containers, and environments where simplicity and maturity matter more than advanced features. Use NTFS for Windows system drives, external drives that need cross-platform compatibility, and environments that rely on Windows-specific features like EFS or ACL integration. Use ZFS when data integrity is critical — NAS appliances, database servers, backup targets, and any system where bit rot is a real concern. ZFS also excels when you need snapshots, compression, and software RAID without sacrificing data safety.