File Systems & Storage Troubleshooting
Why disks fail in visible patterns
Open interactive version (quiz + challenge)Real-world analogy
A file system is a library catalogue. It doesn’t hold the books — it tells you exactly which shelf each book is on. Corrupt the catalogue and all the books are still there, but nobody can find them. That’s why a ‘healthy’ disk can still look empty.
What is it?
A file system is how the OS organizes data on storage: directories, files, metadata, permissions, journaling. Troubleshooting storage means looking at health (SMART), integrity (chkdsk/fsck), and capacity (free space) — in that order, safely.
Real-world relevance
A teller reports ‘files are missing.’ A careful junior checks Recycle Bin, Shadow Copies, backup, and then SMART. Sometimes the files were deleted, sometimes they were on a failing disk, sometimes a GPO redirected the folder. Jumping to ‘reinstall’ destroys the evidence.
Key points
- NTFS, FAT32, exFAT, ext4, XFS, APFS — when each appears — NTFS: Windows system drives (permissions, journaling). FAT32: old USB sticks (max 4GB file). exFAT: modern cross-platform USB/SSD. ext4/XFS: Linux. APFS: modern macOS. If you see a file system, you can predict the OS context.
- Partitioning basics — A disk is divided into partitions. Each partition can have its own file system. Enterprises often separate OS, data, and recovery partitions — makes reinstalls safer.
- SMART — the disk’s self-report — Most drives expose SMART data: reallocated sectors, pending sectors, read errors, temperature, power-on hours. Rising reallocated/pending sectors is an early warning — treat it as ‘order a replacement now.’
- chkdsk (Windows) and fsck (Linux) — These check file-system integrity and repair some errors. Run with care — they can take hours on large volumes and may alter data. Always back up first if the data is irreplaceable.
- Free space, snapshots, and shadow copies — Low free space can cause OS + app misbehavior. Enterprises use Volume Shadow Copy (VSS) to take point-in-time snapshots for backup. Know they exist; don’t delete them casually.
- Permissions belong to the file system — On NTFS, file/folder permissions are part of the metadata. On FAT32, permissions don’t exist. If you copy NTFS files to a FAT USB, you lose permissions — a classic support gotcha.
- Safe first actions when a disk misbehaves — Stop heavy writes, capture SMART, check free space, check Event Viewer for disk errors, test with a known-good cable/bay if external. Never run aggressive repair on a drive you haven’t backed up.
Code example
// Safe storage triage
1. Stop unnecessary writes (close big apps, pause cloud sync).
2. Capture SMART with a read-only tool:
Windows: smartctl -a /dev/pd0 (via smartmontools)
Linux: sudo smartctl -a /dev/sda
3. Check free space on every volume.
4. Review Event Viewer: "disk", "ntfs", "volmgr" sources.
5. Verify backups exist and are recent.
6. Only then run chkdsk / fsck if required.
7. Document timestamps, symptoms, and SMART output in the ticket.Line-by-line walkthrough
- 1. Safe storage triage steps
- 2. Stop unnecessary writes to preserve state
- 3. Capture SMART data read-only
- 4. Check free space on every volume
- 5. Review disk-related Event Viewer sources
- 6. Confirm backups exist and are recent
- 7. Only then consider chkdsk/fsck
- 8. Document everything with timestamps
Spot the bug
Action taken by a junior:
1. User reports missing files.
2. Junior immediately runs chkdsk /f /r on the drive.
3. chkdsk replaces orphaned clusters; data becomes harder to recover.
4. Ticket closed: 'disk checked, files gone'.Need a hint?
What critical step was skipped before running a repair tool?
Show answer
A backup/image of the current state was not taken, and less destructive options (Recycle Bin, Shadow Copies, backups, SMART check) were not tried first. Correct order: preserve state → check safe recovery sources → capture SMART → take image if possible → THEN consider chkdsk. Document every step.
Explain like I'm 5
The file system is like the library’s label system. If the labels get messy, the books are fine but you can’t find them. SMART is the librarian whispering ‘the shelves are bending, please notice before they fall.’
Fun fact
Microsoft’s Volume Shadow Copy lets you right-click a folder in Windows and ‘Restore previous versions.’ Most users don’t know it exists. It has saved more spreadsheets than any recovery tool in history.
Hands-on challenge
On your own machine, find the file system of each drive and its free space. Right-click an important folder → ‘Properties’ → ‘Previous Versions’ or use Time Machine / Linux snapshots. Note whether shadow copies exist.
More resources
- NTFS overview (Microsoft Learn)
- SMART (self-monitoring) explained (Wikipedia)
- File systems in 100 seconds (Fireship)