Chapter 6 — Further Reading

Foundations (🔬 / deeper)

• Brian Carrier — File System Forensic Analysis (Addison-Wesley, 2005). The canonical reference behind this entire chapter. Carrier dissects FAT, NTFS, and ext at the byte level: MFT records and attributes, data runs, FAT directory entries and cluster chains, inodes and block pointers, and precisely what each file system does on deletion. If you read one book to go deeper, read this one — and keep it on the bench.
• NTFS on-disk documentation (the Linux-NTFS / NTFS-3G project notes) and Microsoft's NTFS file-system reference. For hand-decoding records: attribute types (0x10 $STANDARD_INFORMATION`, `0x30` `$FILE_NAME, 0x80 $DATA), the record flags at 0x16, the fixup/update-sequence array, and data-run encoding.
• The ext4 Disk Layout (kernel.org wiki). The authoritative description of inodes, the extent tree (magic 0xF30A), dtime, superblock backups, and the jbd2 journal that extundelete mines.

Approachable explanations (everyone)

• Nelson, Phillips & Steuart — Guide to Computer Forensics and Investigations. A friendly, course-style treatment of deletion, formatting, and recovery that pairs well with this chapter if Carrier feels steep on a first pass.
• The Sleuth Kit & Autopsy documentation (sleuthkit.org). Readable, example-driven docs for fls, icat, and tsk_recover — the read-only, reproducible workflow this chapter uses for forensic recovery.
• CGSecurity's TestDisk & PhotoRec wiki (cgsecurity.org). Christophe Grenier's step-by-step guides for partition repair (TestDisk) and signature carving (PhotoRec), with screenshots of the exact menus shown in this chapter.

In practice (💾 Recovery · 🔍 Examiner · 🛡️ IR · 📜 Legal)

• 💾 DMDE, R-Studio, and UFS Explorer documentation and free preview/scan modes. Use a scan mode to see what is recoverable before quoting — and to learn how each tool tiers results (intact metadata vs. reconstructed vs. raw carved).
• 🔍 extundelete man page and journal-recovery write-ups. The clearest way to internalize why ext4 recovery is journal-bound and time-sensitive.
• 🛡️ DFIR field notes on "do not touch the live machine." Case Study 2 is a recurring incident-response disaster; reading a few real post-mortems makes the lesson stick.
• 📜 Sedona Conference / FRCP commentary on preservation and spoliation. Why "we were only trying to help" is not a defense, and what duty to preserve means in practice.

Reference (this book)

• Appendix C — Tool Reference: TestDisk, PhotoRec, DMDE, R-Studio, UFS Explorer, Sleuth Kit at a glance.
• Appendix G — File-System Reference: NTFS MFT, ext4 inode, FAT/exFAT structures and offsets.
• Appendix H — Command-Line Reference: dcfldd, fls, icat, tsk_recover, extundelete, mount -o ro,sb=….
• Appendix J — Practice Images & Lab Setup: where to get safe images to recover from.
• Chapter 9 — SSD and Flash Recovery: why TRIM changes everything for deleted-file recovery.

Do, don't just read

• Build the practice image from the chapter's "Try This," then watch your "deleted" files reappear. Copy a dozen photos to a USB stick, delete them, image with dcfldd, hash the image, and run fls/icat and TestDisk against it. Decoding one data run by hand and seeing the recovered JPEG open teaches the lesson no paragraph can. Then deliberately recover onto the source on a throwaway image and watch yourself destroy the remaining files — once you have seen that, you will never do it for real.

Next: Chapter 7 — File Carving: when the file system gives out — MFT overwritten, FAT chain gone, ext4 extents zeroed — you recover files straight from raw data by their signatures, with no metadata at all.