Commodity file systems trust disks to either work or fail completely, yet modern disks exhibit more complex failure modes. We suggest a new fractured failure model for disks, which incorporates realistic localized faults such as latent sector errors and block corruption. We then develop and apply a novel faultinjection framework, to investigate how commodity file systems react to a range of more realistic disk failures. We classify their failure policies in a new taxonomy that measures their

more »

... ernal RObustNess (IRON), which includes both failure detection and recovery techniques. We show that commodity file system failure policies are often inconsistent, sometimes buggy, and generally inadequate in their ability to recover from localized disk failures. Finally, we design, implement, and evaluate a prototype IRON file system, ixt3, showing that techniques such as in-disk checksumming and replication greatly enhance file system robustness while incurring minimal time and space overheads.