Chapter 4 — Further Reading

File systems reward the reader who goes to primary structures, so the best sources here are the canonical references and the documentation written by the people who designed (or reverse-engineered) these formats. Resources are grouped by who benefits most.

Foundations (🔬 deeper)

• Brian Carrier, File System Forensic Analysis (Addison-Wesley). The single most important book behind this chapter. Carrier walks NTFS, FAT, ext, and the volume layer structure-by-structure, byte-by-byte — the MFT, attributes, data runs, inodes, and exactly what deletion changes. If you own one reference for Part I, own this one. Read the NTFS and Ext chapters alongside this chapter's diagrams.
• Russinovich, Solomon & Ionescu, Windows Internals. The authoritative treatment of NTFS from the OS side — the MFT, attributes, $LogFile, the USN journal, and how Windows actually writes the timestamps you will later contest in court.
• Apple, Apple File System Reference (developer.apple.com, free PDF). The official APFS specification: containers, volumes, object maps, the B-trees, snapshots, and copy-on-write. Dense but definitive when a Mac case demands ground truth.
• The ext4 disk-layout documentation (kernel.org / ext4 wiki). The maintainers' description of the superblock, block group descriptors, inodes, extents, and the jbd2 journal — the reference behind every extundelete decision.

Approachable explanations (everyone)

• The Sleuth Kit wiki and Carrier's TSK design notes (sleuthkit.org). Plain-language explanations of the layer model — partition, file system, metadata, content — that maps one-to-one onto mmls → fsstat → fls/istat → icat.
• "NTFS MFT explained" / data-run walkthroughs (various DFIR blogs). Short, worked decodings of an MFT record and a data run are the fastest way to make this chapter's hex diagrams click.
• Hex-editor practice with a live volume. Ten minutes pointing xxd, HxD, or Format-Hex at a real boot sector to spot NTFS, EFI PART, or the 0xEF53 superblock magic teaches more than any amount of reading.

In practice (💾 Recovery · 🔍 Examiner · 🛡️ IR · 📜 Legal)

• 💾 extundelete / ext4magic and PhotoRec/TestDisk docs (CGSecurity). Journal-based ext4 recovery and partition/carving recovery — the direct embodiment of "the data outlived the map." Read now; you use them in Chapter 6 and Chapter 7.
• 🔍 Eric Zimmerman's MFTECmd and the SANS Windows forensics posters (free). Parse $MFT`, `$LogFile, and $UsnJrnl` at scale and read both timestamp sets — the operational version of this chapter's `$SI/$FN lesson.
• 🛡️ USN-journal and $LogFile parsing tools (UsnJrnl2Csv, NTFS Log Tracker). The change-history artifacts an IR analyst mines to reconstruct what an attacker created, renamed, and deleted.
• 📜 The Sedona Conference commentary on ESI and spoliation. Why deleted-but-recoverable metadata is routinely discoverable and how preservation duties attach — the legal weight of this chapter's central fact.

Reference (this book)

• Appendix G — File System Reference: NTFS MFT, ext4 inode, APFS, and FAT/exFAT structures with the offsets you need to parse them by hand.
• Appendix H — Command-Line Reference: mmls, fsstat, fls, istat, icat, extundelete, and xxd in copy-ready form.
• Appendix A — File Signatures Reference: the headers/footers you fall back to when the file system's map is gone and you must carve.
• Appendix J — Practice Images and Lab Setup: free, legal images so this chapter's labs are real.
• Chapter 6 — Logical Recovery and Chapter 21 — Timeline Analysis: the deep dives this chapter sets up.

Do, don't just read

• Run the full TSK pipeline on a practice image: mmls → fsstat → fls -r -p → icat a deleted file → verify with file and a hash. (Exercise 4.27.)
• Compare $SI` and `$FN. istat a file and read both timestamp sets; learn to spot the "modified before created" impossibility. (Exercise 4.29.)
• Decode a data run by hand — 21 18 34 56 00 — then check it against icat's output. (Exercise 4.10.)
• Create and delete a file on a loopback ext4 image, then recover it with extundelete — and watch how a few writes shrink the window. (Exercise 4.28.)

Next: Chapter 5 — The Forensic Process: turning these recovery instincts into a defensible method — acquisition, write-blocking, hashing, chain of custody, analysis, and the report — where "I found this" becomes "I can prove it, unaltered."