I want to encrypt the files stored in SD card and I am using the CTR mode of AES to encrypt it. The key and IV are fixed. So each time I encrypt/decrypt I use the same key and nonce. Most of the people suggest not to use same nonce repeatedly. In my case since it is not the communication between two parties I think it is harmless. Is my assumption correct?
You must not do this.
AES in CTR mode turns it into a stream cipher, such that AES is turned into a cryptographic pseudorandom number generator (PRNG) which generates a sequence of pseudorandom bits to be used as a keystream. This output keystream is simply xor'ed with the plaintext stream to produce ciphertext. Using the same key and IV produces the same keystream each time, so by re-using the key and IV you're essentially using a many-time pad.
So, you get:
C1 = M1 ⊕ K
C2 = M2 ⊕ K
Where C is ciphertext, M is the plaintext message, K is the keystream produced by AES-CTR, and ⊕ denotes an exclusive-or (xor) operation.
By computing the xor of those two ciphertexts, you get:
C1 ⊕ C2 = M1 ⊕ K ⊕ M2 ⊕ K
which, after cancelling out the two K values (since x ⊕ x ≡ 0) gives us:
M1 ⊕ M2
This allows an attacker to know which bits of M1 are equal to M2. If you know any bits of one message (known plaintext), you can then recover the corresponding bits from the other message. You can also employ techniques such as crib-dragging to fully decrypt the entire message.
There's a great answer on Crypto SE about exactly how this attack works.
You should always use a unique IV per message to avoid this problem.
With identical key and IV, you'll produce identical ciphertext for identical plaintext.
Scenario: You send messages to your broker via this scheme, and don't worry about the messages being intercepted because you've encrypted them. C1 reads:
Stock: Cocoa-Cola Order: Buy Shares: 1,000,000 Price: > $20
Someone steals your SD card while you're not looking, and copies the ciphertext. Later on through other means, finds out you bought 100 shares of coca-cola.
Coke keeps going up, so you buy more shares. C2 reads:
Stock: Coca-Cola Order: Buy Shares: 3,000,000 Price: >$30
The attacker has noticed the first part of your message hasn't changed. Later on, you're observed buying 300 shares of coca-cola. Now the attacker has an idea of the format of your messages.
Coke is skyrocketing, so you decide to buy even MORE coke shares. C3 reads
Stock: Coca-Cola Order: Buy Shares: 5,000,000 Price: >$40.
The first part of the message is STILL the same, so the attacker has a damn good idea that you're going to buy Coke shares. He doesn't know how many, but based on past purchased he can have a good idea.
Thus your encryption has been foiled. Further messages back and forth will only break more and more of the ciphertext. This is similar to the scenario the NSA used against the Soviet union when the soviets re-used a one time pad in project verona https://en.wikipedia.org/wiki/Venona_project