Chapter 7 — Further Reading

Foundations (🔬 / deeper)

• Simson Garfinkel — "Carving Contiguous and Fragmented Files with Fast Object Validation" (Digital Investigation, DFRWS 2007). The paper behind half this chapter. It introduces object validation, bifragment gap carving, and the secondhand-drive fragmentation statistics (~6% overall, ~16% of JPEGs, >50% of PST stores) quoted in the text. If you read one source to go deeper, read this.
• Golden G. Richard III & Vassil Roussev — "Scalpel: A Frugal, High Performance File Carver" (DFRWS 2005). The design and rationale for Scalpel's two-pass, configuration-driven approach — and a clear statement of where pure signature carving ends and smart carving begins.
• Brian Carrier — File System Forensic Analysis (Addison-Wesley, 2005). For why carving is necessary and what "unallocated space" and "slack" actually are at the byte level. Pairs with this chapter the way it paired with Chapter 6.
• The DFRWS File Carving Challenges (2006 and 2007). The community test images that drove carver development, with fragmented and nested files designed to break naive tools. Working a challenge image teaches more than any reading.

Approachable explanations (everyone)

• CGSecurity's PhotoRec & TestDisk wiki (cgsecurity.org). Christophe Grenier's step-by-step guides, including the exact "File Opt" and "free space only" menus shown in this chapter. The friendliest on-ramp to real carving.
• The Foremost and Scalpel man pages / READMEs. Short, concrete, and the authoritative reference for the extension case max-size header [footer] [REVERSE] configuration-line format you wrote in the exercises.
• The file command and libmagic documentation. How magic-number identification actually works — the same idea your carver uses, just for one file at a time. Read it and you will never trust an extension again.
• Nelson, Phillips & Steuart — Guide to Computer Forensics and Investigations. A gentle, course-style treatment of carving and data recovery if the DFRWS papers feel steep on a first pass.

In practice (💾 Recovery · 🔍 Examiner · 🛡️ IR · 📜 Legal)

• 💾 PhotoRec's per-format "File Opt" workflow. Practice disabling every format but the few you need; it is the single biggest time-saver in real recovery jobs, as Case Study 1 showed.
• 🔍 Garfinkel's bulk_extractor Users Manual. The definitive guide to feature scanning, forensic paths (offset-ZIP-offset), histograms, and the scanners (email, URL, CCN, EXIF, GPS) that find what carving cannot.
• 🛡️ Carving and feature-scanning memory images. bulk_extractor and PhotoRec against RAM dumps pull configuration fragments, keys, and artifacts that never touched disk — a bridge to Chapter 22 — Memory Forensics.
• 📜 Authentication of digital evidence (FRE 901) and the Daubert standard. Why a carved file's lack of file-system metadata changes how you authenticate it — the exact issue that nearly sank Case Study 2. Detailed in Chapter 25.

Reference (this book)

• Appendix A — File Signatures Reference: hundreds of headers and footers with offsets and notes — the carver's field guide.
• Appendix B — Python Forensics Toolkit: a better-behaved version of the chapter's minimal carver, plus the hashing and triage scripts.
• Appendix H — Command-Line Reference: blkls, photorec, foremost, scalpel, bulk_extractor, xxd, file.
• Appendix J — Practice Images & Lab Setup: ground-truth and public corpus images to carve safely.
• Chapter 9 — SSD and Flash Recovery: why TRIM can erase the unallocated space you would carve.
• Chapter 20 — Photo, Video, and Document Forensics: mining the EXIF that survives a carve.

Do, don't just read

• Build the ground-truth image from the chapter's "Try This," then carve it and grade yourself. Format a stick FAT32, copy on a dozen photos plus a PDF and a video, record each file's SHA-256, delete and reformat, image with dcfldd, then blkls and run PhotoRec. Hash-match the carves against the originals: count the byte-perfect ones, and for every mismatch decide whether it was a thumbnail truncation, a fragmentation splice, or a false positive. There is no faster way to turn this chapter from words into instinct.

Next: Chapter 8 — Hard Drive Recovery: when the data is fine but the drive is dying — clicking heads, seized motors, dead boards — and you must get an image off failing hardware before any logical or carving technique can even begin.