How storage works

Before you can protect files or get them back, you need a picture of where they live. By the end of this lesson you can name the layers between a photo and the hardware, and say what happens to that photo when you delete it.

From drive to file: four layers

Every file you save passes through four layers. Recovery tools, backup tools and error messages all talk about one of them, so it helps to know which.

  ┌───────────────────────────────────────────────┐
  │  Files and folders    Photos/beach.jpg        │  what you see
  ├───────────────────────────────────────────────┤
  │  Filesystem           ext4, NTFS, exFAT ...   │  the index: names, folders,
  │                                               │  which blocks hold what
  ├───────────────────────────────────────────────┤
  │  Partition            sda2, "C:"              │  a slice of the drive
  ├───────────────────────────────────────────────┤
  │  Drive                HDD, SSD, SD card       │  the hardware that keeps
  │                                               │  numbered blocks of data
  └───────────────────────────────────────────────┘

A drive only knows numbered blocks. The filesystem is the index that turns "block 81 920 to block 82 431" into beach.jpg in the folder Photos. Most data loss is damage to one layer while the layers below are fine. That is why recovery is often possible.

Kinds of drive

Drive	How it stores data	What to know
Hard disk (HDD)	Magnetic spinning platters, read by a moving head	Cheap per terabyte. Dislikes knocks, especially while running. Often warns before it dies: noises, slowness, read errors
Solid-state drive (SSD)	Flash memory chips run by a controller, no moving parts	Fast and quiet. Each block survives a limited number of writes. Can fail suddenly. Erases deleted data by itself (see TRIM)
USB stick, SD card	Cheaper flash memory with a simple controller	Often lost, and damaged by being pulled out mid-write. Usually report no health data at all

SSDs connect either through SATA (the same plug as a hard disk) or NVMe (a small card in an M.2 slot, much faster). Phones and many laptops have flash memory soldered to the board, which you cannot take out.

Partitions

A partition is a slice of a drive that the computer treats as a separate disk. A table at the start of the drive, the partition table, records where each slice begins and ends. Modern computers use the GPT format; older ones use MBR.

On Linux, lsblk lists drives and their partitions. Here it is on a laptop with two SSDs:

lsblk -e7 -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINTS

NAME          SIZE TYPE FSTYPE    MOUNTPOINTS
sda         447.1G disk
├─sda1          1G part vfat      /boot/efi
└─sda2      446.1G part ext4      /
nvme0n1     476.9G disk
├─nvme0n1p1   450M part vfat
├─nvme0n1p2    16M part
├─nvme0n1p3 474.5G part BitLocker
└─nvme0n1p4     2G part ntfs

Read it like this:

• sda and nvme0n1 are the two drives (-e7 hides loop devices, which are not real drives). sda1, nvme0n1p3 and so on are partitions.
• FSTYPE is the filesystem in each partition. sda2 holds Linux (ext4) and is mounted at /: it is in use as the main system disk.
• nvme0n1p3 is a Windows partition encrypted with BitLocker. Without the key, its contents are unreadable, to a thief and to a recovery tool alike.

lsblk -d -o NAME,SIZE,ROTA,TRAN adds ROTA (1 for a spinning hard disk, 0 for flash) and TRAN (how it is connected: sata, nvme, usb). On Windows, Disk Management shows the same picture.

Filesystems and their limits

A filesystem decides how names, folders, dates and permissions are stored. Which one a drive uses decides who can read it and how big a single file can be.

Filesystem	Where you meet it	Limits and quirks
ext4	The usual Linux system disk	Linux only: Windows and macOS cannot read it without extra software. Files up to 16 TiB
NTFS	Windows system and data disks	Large files. Linux reads and writes it; macOS reads it but does not write to it out of the box
FAT32	Older USB sticks and small SD cards	Read by almost everything, but no single file can be 4 GiB or larger. Windows' own format tool offers FAT32 only up to 32 GB
exFAT	Most USB sticks and SD cards over 32 GB	No practical file size limit. Read by Windows, macOS, Linux, cameras and phones

Two practical lessons follow:

• A 6 GB video "will not copy" to a stick with plenty of free space? The stick is FAT32. Use exFAT, or split the file.
• ext4 and NTFS keep a journal, a log of changes about to be made, so an interrupted write can be tidied up on the next start. FAT32 and exFAT have none. Pulling a stick out while it writes is the classic way to damage its file list. Use Eject or Safely remove before you unplug.

What deleting really does

Deleting a file usually happens in two stages, and neither of them wipes the data at once.

  You press Delete
        │
        ▼
  ┌────────────────────┐   still fully there; restore it from
  │ Trash/Recycle Bin  │   the Trash with one click
  └─────────┬──────────┘
            │ Empty Trash  (or Shift+Delete)
            ▼
  ┌────────────────────┐   name gone from the folder;
  │ Filesystem forgets │   blocks marked "free to reuse"
  └─────────┬──────────┘
            │ new files written
            ▼
  ┌────────────────────┐   old data replaced:
  │ Blocks overwritten │   gone for good
  └────────────────────┘

Between the second and the third stage the data is still on a hard disk or memory card. The filesystem has only forgotten where it is. Recovery tools find it again, through leftover entries in the file list or by searching the raw blocks for the start of a JPEG or a video.

You can see that a name and its data are separate things. A hard link is a second name for the same data:

printf 'notes\n' > report.txt
ln report.txt report-link.txt      # a second name for the same data
ls -li report*.txt

184412 -rw-rw-r-- 2 dhivakar dhivakar 6 Nov  9 17:44 report-link.txt
184412 -rw-rw-r-- 2 dhivakar dhivakar 6 Nov  9 17:44 report.txt

Both names show the same inode number (184412, the filesystem's record for the data) and a link count of 2. Delete one name with rm report.txt, and report-link.txt still opens with the same contents. Deleting removes a name; the filesystem frees the blocks only when no name points to them any more, and even then it does not erase them.

Formatting is a bigger version of the same thing. A quick format writes a fresh, empty file list and leaves the old data in place, which is why photos can often be recovered from a card that was formatted by mistake. A full format on Windows (with Quick Format unticked) also writes zeros over the whole partition; after that there is nothing to recover.

TRIM: why SSDs forget deleted files

Flash memory cannot overwrite a block in place: it has to erase it first, and erasing is slow. So the computer tells the SSD which blocks the filesystem no longer uses. That message is called TRIM (or "discard"). The SSD then erases those blocks in the background, ready for new writes, and a read of a trimmed block returns zeros.

TRIM keeps an SSD fast and helps it last. For recovery it is bad news: on an SSD, a deleted file is usually erased by the drive itself within minutes, and no software can read it back. Recovering deleted files from an internal SSD rarely works. Files that still exist on a failing SSD are a different matter: those can be copied off.

Check whether a drive accepts TRIM with lsblk --discard. Non-zero DISC-GRAN and DISC-MAX mean it does:

lsblk -e7 --discard

NAME        DISC-ALN DISC-GRAN DISC-MAX DISC-ZERO
sda                0      512B       4G         0
├─sda1             0      512B       4G         0
└─sda2             0      512B       4G         0
nvme0n1            0      512B       2T         0
…

Windows sends TRIM as files are deleted and again when it optimises the drive. Ubuntu runs a weekly TRIM job:

systemctl list-timers fstrim.timer

NEXT                          LEFT LAST                         PASSED UNIT         ACTIVATES
Mon 2026-11-16 00:04:03 IST 6 days Mon 2026-11-09 00:36:00 IST 17h ago fstrim.timer fstrim.service

Many USB sticks and memory cards in a card reader never receive TRIM, so deleted photos on them often survive until something overwrites them. Do not count on it: some do.

Good to know

The lesson for an SSD is not "recovery will save me". It is "have a backup before you delete". That is the next lesson.

Signs a drive is failing

Drives rarely die without any hint. Watch for:

• a hard disk that clicks, grinds, beeps or spins up and down again;
• files that suddenly will not open, or copies that stop with "I/O error" or "cyclic redundancy check";
• the whole computer freezing for seconds while it reads a file;
• a drive that disappears and reappears, or shows a wrong size, such as 0 bytes;
• a memory card that the camera calls "card error" or the computer wants to format.

Most hard disks and SSDs also keep a record of their own wear and errors, called SMART (Self-Monitoring, Analysis and Reporting Technology). It counts things like hours of use, blocks the drive has replaced because they went bad, and, for SSDs, how much of the rated wear is used. USB sticks and SD cards usually keep no such record.

To read it, use the Disks tab of SysVitals: it shows SMART: HEALTHY or SMART: CRITICAL for NVMe drives, a Health bar with the life remaining, and for SATA drives the drive's own verdict, usually PASSED, plus reallocated sectors. Full health data needs root. The command-line tool smartctl from the smartmontools package gives the drive's overall verdict:

sudo smartctl -H /dev/sda

…
SMART overall-health self-assessment test result: PASSED

A PASSED drive can still fail tomorrow; SMART catches many failures, not all. A reallocated sector count that keeps rising, media errors on an SSD, or anything other than PASSED means: copy your data off now.

Stay safe

• Know which drive is which before you format, partition or recover. Check the size and model in lsblk or Disk Management twice. Formatting the wrong disk is the most common self-inflicted loss.
• Eject before you unplug, especially FAT32 and exFAT sticks.
• Treat an SSD delete as final. Empty the Trash only when you are sure, or when you have a backup.
• Act on warnings. A noisy disk or a red health bar is a reason to copy files today, not to run a long test first.
• Do not open a hard disk. Dust ruins the platters. Mechanical failures belong to a recovery lab.

Check yourself

QuizHow storage works

Question 1 of 6

You try to copy a 6 GB video onto a USB stick with 20 GB free, and the copy fails. What is the most likely reason?

Score: 0

What you learned

• A file sits on a filesystem, inside a partition, on a drive. Loss is usually damage to one layer.
• FAT32 cannot hold a file of 4 GiB or more; exFAT can, and is read almost everywhere.
• Deleting and quick formatting remove names, not data. Data goes only when it is overwritten.
• On SSDs, TRIM erases deleted data within minutes, so recovery rarely works there.
• SMART and tools like SysVitals show a drive's health, and noises, errors and a rising reallocated count are warnings to copy data now.

Next steps

• Backups that work: make deleting and dead drives harmless
• Check drive health with SysVitals
• Before you start a recovery with DiskRescue