Chapter 2 — Further Reading

The literacy in this chapter — bits, hex, sectors, clusters, and "deleted ≠ destroyed" — is bedrock, so the best sources are the ones that make it physical and the ones you can practice against. Resources are grouped by who benefits most.

Foundations (🔬 deeper)

• Brian Carrier, File System Forensic Analysis (Addison-Wesley). The canonical reference for everything in this chapter and the next two: sectors, clusters, the logical/physical divide, and exactly what "deleted" means structure by structure. Dense, authoritative, worth owning. Start with the early chapters on volume and file-system fundamentals.
• NIST SP 800-88 Rev. 1, Guidelines for Media Sanitization (free PDF). The authoritative, vendor-neutral treatment of what actually destroys data — the flip side of recovery. It is also the citation that retires the multi-pass-overwrite folklore: on modern drives, a single overwrite (or a verified secure-erase command) suffices.
• Wright, Kleiman & Sundhar, "Overwriting Hard Drive Data: The Great Wiping Controversy." The empirical paper behind the single-pass claim — a good model of evidence-based skepticism toward forensic urban legends.

Approachable explanations (everyone)

• Charles Petzold, Code: The Hidden Language of Computer Hardware and Software. The friendliest possible route into binary, bytes, and why two states won — builds the intuition this chapter assumes, from the ground up, with almost no math anxiety.
• Gary Kessler's File Signatures table (online). A continuously maintained list of magic numbers/headers and footers. Bookmark it; you will reach for it constantly when a header looks familiar but you cannot place it.
• Any hands-on "hex editor tutorial" for HxD (Windows) or xxd (Linux/macOS/WSL). Ten minutes of clicking around a real file teaches more than any amount of reading about the three-column layout.

In practice (💾 Recovery · 🔍 Examiner · 🛡️ IR · 📜 Legal)

• 💾 PhotoRec / TestDisk documentation (CGSecurity). Free, signature-based carving and partition recovery — the direct, practical embodiment of "the data outlived the pointer." Read the docs now; you will use the tools in Chapters 6–7.
• 🔍 The Sleuth Kit & Autopsy documentation. fls, icat, and the Autopsy GUI let you walk a file system's deleted entries and pull data by cluster — the chapter's concepts made operational.
• 🛡️ SANS DFIR "find evil"/file-signature posters and cheat sheets (free). Compact references for signatures and offsets that live well next to your keyboard during an incident.
• 📜 The Sedona Conference, commentary on ESI and preservation. Why deleted-but-recoverable data is routinely discoverable, and how spoliation duties attach — the legal weight of this chapter's central fact.

Reference (this book)

• Appendix A — File Signatures Reference: the headers/footers behind FF D8 FF, 50 4B 03 04, 25 50 44 46, 4D 5A, and dozens more — the carving lookup table.
• Appendix H — Command-Line Reference: xxd, dd/dcfldd, hashdeep, strings, and the offset arithmetic, in copy-ready form.
• Appendix G — File System Reference: NTFS MFT, FAT, and ext4 structures, with the endianness and offsets you need to parse them by hand.
• Appendix J — Practice Images and Lab Setup: where to get free, legal practice images so the labs in this chapter are real, not hypothetical.
• Chapter 4 — File Systems: the per-file-system detail of exactly what deletion changes, owned in full.

Do, don't just read

• Open three files in a hex editor and read their signatures — a .jpg, a .pdf, and a .zip/.docx. Confirm each against Appendix A. (Exercise 2.9.)
• Prove an extension can lie. Copy a .jpg to a .txt name and dump it; watch FF D8 FF stay put. (Exercise 2.27.)
• Run the arithmetic until it is automatic. Convert sector 2048 to a byte offset and byte offset 1 GiB to a sector, on both a 512n and a 4Kn drive. (Exercises 2.17–2.19, 2.29.)
• Image a practice USB and hash it twice. Feel what "the original is sacred" means in your hands before a real case forces the lesson. (Exercise 2.26.)

Next: Chapter 3 — Storage Technology: from a single stored bit to the whole machines — HDD and SSD anatomy, how they fail, RAID/NAS/SAN, and what each failure means for getting the data back.