Start here. This is the direct spoken answer to practice first.
Why this question matters
File systems are dangerous in interviews because candidates often focus only on uploading bytes. Real designs need metadata, access control, streaming, validation, storage lifecycle, and security boundaries.
I would store file metadata in the database and the actual bytes in durable object storage, not inside the web server's local disk. The upload flow would validate size, type, ownership, and user permission, then stream the file to storage or to a controlled staging area. Downloads would check authorization each time and return either a short-lived signed URL or a streamed response. The database record would track owner, status, storage key, size, content type, and created time.