Understanding ext4, NTFS, and APFS File Systems: Basic Concepts

Documentation Resources

For those looking to explore these file systems in greater technical depth:

ext4 Documentation

• Linux Kernel ext4 Documentation
• ext4 Wiki on kernel.org
• The Linux Documentation Project: ext4

NTFS Documentation

• Microsoft’s NTFS Technical Reference
• Windows Internals Book Series

APFS Documentation

• Apple File System Reference
• APFS Guide for Developers
• File System Programming Guide

Introduction

Modern operating systems rely on sophisticated file systems to organize, store, and retrieve data efficiently.

Among the most prominent are

• Linux’s ext4 (Fourth Extended File System)
• Microsoft’s NTFS (New Technology File System)
• Apple’s APFS (Apple File System)

This blog explores the underlying principles, architecture, and design choices behind these file systems, highlighting their similarities and differences.

ext4: The Standard Bearer for Linux

df -T

The Fourth Extended Filesystem (ext4) has been the default file system for most major Linux distributions since around 2008, succeeding its predecessor ext3.
It maintains backward compatibility while introducing significant improvements in performance, reliability, and capacity.

Core Architecture

ext4 follows the traditional Unix-style file system architecture with some modern enhancements:

• Inode-Based Structure: Each file or directory is represented by an inode that stores metadata and pointers to data blocks
• Block Groups: The file system is divided into block groups, each containing a copy of critical file system data for robustness
• Extent-Based Storage: Unlike the older indirect block approach, ext4 uses extents to map contiguous blocks of data

Key Design Features

Extents

Instead of mapping individual blocks, ext4 uses extents that represent contiguous ranges of blocks:

Extent Format:
- Physical block start
- Logical block start 
- Block count

This reduces metadata overhead and improves performance for large files.

Delayed Allocation

ext4 implements delayed block allocation, postponing the assignment of actual disk blocks until data is written to disk. This optimizes block allocation decisions and reduces fragmentation.

Journal Checksumming

ext4 enhances the journaling mechanism with checksums to verify the integrity of journal data, increasing reliability without significant performance impact.

Multiblock Allocation

The file system can allocate multiple blocks in a single operation, improving efficiency when creating or extending files.

Online Defragmentation

ext4 supports defragmentation of files while the file system is mounted and in use, without requiring downtime.

Fast fsck

The file system check utility (fsck) for ext4 is significantly faster than for previous versions, reducing recovery time after system crashes.

NTFS: The Backbone of Windows Storage

NTFS has been the default file system for Windows since Windows NT, replacing the older FAT file system with a more robust and feature-rich alternative.

Core Architecture

At the heart of NTFS lies the Master File Table (MFT), a database that tracks every file and directory on a volume.
Each file or directory corresponds to at least one record in the MFT, with each record containing:

• File metadata (creation time, modification time, permissions)
• Data attribute information
• File name information
• Security descriptors
• Data content (for small files)

This structure allows NTFS to handle both the organizational aspects of data and the data itself within a unified framework.

Key Design Features

Journaling Mechanism

NTFS implements a journaling system through its “Log File Service” that records pending changes to the file system structure before they’re committed.
This approach ensures that if a system crash occurs during a file operation, the file system can be restored to a consistent state upon reboot, preventing corruption.

Transaction Process:
1. Write intent to log
2. Make actual changes to file system
3. Mark transaction as complete in log

B+ Tree Directory Structure

NTFS utilizes B+ tree data structures for organizing directories, enabling efficient lookups even in directories containing thousands of files.
This structure ensures that file access operations maintain good performance regardless of directory size.

Sparse Files and Compression

NTFS can efficiently handle files with large empty sections by only allocating disk space for portions that contain actual data. This feature, combined with built-in compression capabilities, allows for more efficient storage utilization.

Security Model

The Access Control List (ACL) system in NTFS provides granular control over file permissions, supporting complex organizational security requirements.

APFS: Designed for Modern Storage Technologies

Released in 2017, APFS represents Apple’s redesign of their file system architecture specifically optimized for solid-state drives and encryption.

Core Architecture

APFS is built around a copy-on-write metadata scheme that enhances data integrity and enables features like snapshots. The file system organizes data using:

• Space Manager: Tracks free and used blocks
• Object Manager: Handles the file system objects
• Encryption Manager: Manages cryptographic operations
• Reaper: Handles deletion and space reclamation

Key Design Features

Copy-on-Write

APFS’s copy-on-write approach means modifications to files create new copies of data rather than overwriting existing data. This design:

• Ensures atomic operations
• Prevents data corruption during system failures
• Enables efficient snapshotting

Copy-on-Write Process:
1. Read original data block
2. Create modified copy in new location
3. Update file system pointers to reference new block
4. Original block becomes available for reuse (or remains as part of a snapshot)

Space Sharing

Multiple volumes on the same APFS container dynamically share available space, eliminating the need to pre-allocate fixed partition sizes. This allows volumes to grow and shrink as needed within the shared pool of storage.

Clones and Snapshots

APFS can create instant file or directory clones that share storage until modified (leveraging copy-on-write). Snapshots preserve the entire file system state at a point in time without duplicating data.

Fast Directory Sizing

Unlike many other file systems (including HFS+), APFS tracks directory sizes in real-time, eliminating the need for time-consuming directory traversal when querying folder sizes.

Encryption Design

APFS was built with encryption as a primary consideration, offering:

• Full-disk encryption
• Multi-key encryption (different keys for different types of data)
• Encryption that works efficiently with the copy-on-write architecture

Comparative Analysis

Feature	ext4	NTFS	APFS
Primary Focus	Reliability and performance	General purpose with enterprise features	SSD optimization and data integrity
Creation Date	2008	1993	2017
Maximum File Size	16 TB (with 4KB blocks)	16 EB (theoretical)	8 EB
Maximum Volume Size	1 EB	256 TB (practical)	8 EB
Journaling	Yes, with checksumming	Yes, transaction-based	No traditional journaling; uses copy-on-write
Case Sensitivity	Yes, always case-sensitive	Configurable, default is insensitive	Configurable
Built-in Encryption	No (relies on layer below)	Yes (EFS, BitLocker)	Yes (integrated)
Space Allocation	Fixed per volume	Fixed per volume	Dynamic across container
Snapshots	Limited (relies on LVM)	Via Volume Shadow Copy	Native, efficient