Chapter 1 — Further Reading

A foundation chapter deserves foundational sources. Start where your path points, but read at least one item from outside it — the cross-disciplinary fluency this chapter argues for begins with reading across the divide.

Foundations (🔬 deeper)

• Brian Carrier, File System Forensic Analysis (Addison-Wesley, 2005). The single deepest book on what this chapter only introduces — how storage and file systems actually work, byte by byte, and why "deleted" means what it means. Written by the author of The Sleuth Kit and Autopsy. You will return to it for years; Chapters 2, 4, and 6 lean on its concepts.
• Eoghan Casey, Digital Evidence and Computer Crime (3rd ed., Academic Press, 2011). The discipline's foundational text on evidence, the scientific method in forensics, and the law that frames it. Read it for why forensics is built the way it is.

Approachable explanations (everyone)

• Bill Nelson, Amelia Phillips & Christopher Steuart, Guide to Computer Forensics and Investigations (Cengage). The classroom standard — broad, readable, and gentle on newcomers. A good companion volume that covers the whole landscape this book threads through 40 chapters.
• Cory Altheide & Harlan Carvey, Digital Forensics with Open Source Tools (Syngress, 2011). Hands-on with exactly the free tools this book favors (The Sleuth Kit, hashing utilities, carvers). The fastest way to feel the foundation under your fingers.
• CGSecurity documentation for TestDisk & PhotoRec (cgsecurity.org). Free, plainly written docs for two of the most useful recovery/carving tools alive. Reading them clarifies "deleted is not destroyed" better than any lecture.

In practice (💾 Recovery · 🔍 Examiner · 🛡️ IR · 📜 Legal)

• 💾 The r/datarecovery community wiki, plus the educational articles published by recovery labs (DriveSavers, Gillware). Real cases, honest limits, and the business reality of Chapter 13.
• 🔍 The SANS DFIR blog and posters (sans.org/blog/?focus-area=digital-forensics) and the Sleuth Kit / Autopsy documentation (sleuthkit.org). Where working examiners publish technique and reference artifacts.
• 🛡️ NIST SP 800-86, Guide to Integrating Forensic Techniques into Incident Response, and NIST SP 800-61, Computer Security Incident Handling Guide (both free PDFs). The clearest statements of how forensics lives inside the incident-response overlap.
• 📜 Daubert v. Merrell Dow Pharmaceuticals, 509 U.S. 579 (1993), and The Sedona Conference Principles on eDiscovery. The reliability standard your evidence must meet, and the framework that governs civil discovery.

Reference (this book)

• Appendix A — File Signatures Reference: the magic numbers behind the FF D8 FF you verified by hand.
• Appendix E — Legal Frameworks Reference: the statutes and standards named throughout the chapter.
• Appendix F — Chain-of-Custody & Report Templates: the forms your Case File starts with.
• Chapter 5 — The Forensic Process: acquisition, hashing, and custody in full.

Do, don't just read

• Verify a signature by hand. Open a .jpg in HxD or xxd and find FF D8 FF at the start and FF D9 at the end. The foundation should be tactile, not theoretical.
• Hash and compare. Hash a file, copy it, hash the copy, confirm they match; then change one byte and watch the hash change utterly. That is integrity, demonstrated.
• Sort three headlines. Find three recent news stories involving lost or recovered data and classify each as recovery, forensics, or "could become forensic." Defend each call in a sentence.
• Start your Case File. Do exercises 1.29–1.32. The act of naming the discipline before anything else is the first lesson.

Next: Chapter 2 — How Data Is Stored: from a single bit to a clustered file system — and exactly what "delete" changes and what it leaves untouched.