Chapter 3 — Further Reading

The fastest way to internalize this chapter is to make the hardware physical — see how a platter and head actually move, watch how NAND and the FTL juggle pages and blocks, and look at real-world failure data instead of folklore. Resources are grouped by who benefits most.

Foundations (🔬 deeper)

• Brian Carrier, File System Forensic Analysis (Addison-Wesley). The early chapters on volumes, disk geometry, and the logical/physical divide are the rigorous version of this chapter's HDD and partition material — and the bridge into Chapter 4. Worth owning for the whole book.
• Emmanuel Goossaert, "Coding for SSDs" (six-part series, codecapsule.com). The clearest free explanation anywhere of NAND organization, the page/block asymmetry, the FTL, wear leveling, garbage collection, and write amplification. If the FTL section felt abstract, read this.
• Schroeder, Lagisetty & Merchant, "Flash Reliability in Production: The Expected and the Unexpected" (USENIX FAST 2016). A large-scale empirical study of how SSDs actually fail in data centers — wear, uncorrectable errors, and the surprises. The evidence behind the chapter's failure-mode claims.
• JEDEC JESD218/219 (endurance and retention standards). The specs behind "data fade": how long a powered, healthy drive must retain data — and why a seized SSD in a drawer operates well outside those assumptions.

Approachable explanations (everyone)

• Branch Education, "How do Hard Drives work?" and "How do SSDs work?" (YouTube). Gorgeous nanometer-scale animations of platters, heads, and the actuator, and of charge trapping in NAND cells. Ten minutes that make the anatomy diagrams move.
• Backblaze Drive Stats (quarterly blog reports). Real failure rates from hundreds of thousands of drives in production — the friendliest possible introduction to the idea that drives have measurable, predictable failure behavior, and that "PASSED" is not the whole story.
• Any SMART-attribute explainer for smartctl / CrystalDiskInfo. A short read on what Reallocated Sector Count, Current Pending Sector, Wear Leveling Count, and percentage_used mean turns a wall of numbers into a triage decision.

In practice (💾 Recovery · 🔍 Examiner · 🛡️ IR · 📜 Legal)

• 💾 ACE Lab PC-3000 and DeepSpar resources. The professional HDD/SSD recovery platforms referenced throughout Part II — service-area repair, head maps, and imaging failing drives. Read about them now; you meet them in Chapters 8–9.
• 💾 Rusolut Visual NAND Reconstructor / PC-3000 Flash docs. How chip-off and monolith recovery actually work — raw NAND dumps, ECC, de-interleaving, and FTL reconstruction.
• 🔍 The Linux RAID wiki and the mdadm man page. mdadm --examine reads the 0xa92b4efc superblock; --assemble rebuilds an array. The hands-on counterpart to the chapter's RAID-geometry section.
• 🔍 SNIA Common RAID Disk Data Format (DDF) specification. The vendor-neutral on-disk metadata standard (signature 0xDE11DE11) you may meet when reverse-engineering a hardware array.
• 🛡️ smartmontools (smartctl) and nvme-cli documentation. The read-only triage commands from this chapter, in depth — your first move on any incident drive.

Reference (this book)

• Appendix C — Tool Reference: PC-3000, R-Studio, UFS Explorer, ReclaiMe, Rusolut — what each does and when to reach for it.
• Appendix H — Command-Line Reference: lsblk, hdparm, smartctl, nvme, mdadm, in copy-ready form.
• Appendix J — Practice Images and Lab Setup: RAID member images and spare-drive sources so the labs are real.
• Chapters 8, 9, and 10: HDD, SSD/flash, and RAID recovery — where every failure mode here becomes a technique.

Do, don't just read

• Triage your own drives. Run lsblk/Get-PhysicalDisk and pull SMART on every drive you own; learn what healthy looks like. (Exercise 3.25.)
• Build and break a RAID 5 by hand. Stripe three small files, XOR a parity block, "fail" a disk, and reconstruct it — then verify bit-for-bit. (Exercise 3.27.)
• Reconstruct a practice array virtually, read-only. Recover disk order and stripe size from member images and mount the result. (Exercise 3.26.)

Next: Chapter 4 — File Systems: up one layer from raw sectors to NTFS, ext4, APFS, FAT, exFAT, and HFS+ — how each organizes a disk, and exactly what each leaves behind when a file is deleted.