Chapter 10 — Further Reading

Foundations (🔬 / deeper)

• "A Case for Redundant Arrays of Inexpensive Disks (RAID)" — Patterson, Gibson & Katz (1988 SIGMOD). The origin paper that named RAID and defined the levels. Read it to see that redundancy and performance were always two sides of the same striping idea — the idea that also makes recovery hard.
• "The mathematics of RAID-6" — H. Peter Anvin. The canonical reference for the Q syndrome: Reed-Solomon over GF(2⁸), the generator g = 0x02, and the 0x11D reduction polynomial. This is why you cannot hand-compute dual-parity recovery and must trust a correct implementation.
• The Linux RAID wiki (raid.wiki.kernel.org) and the mdadm / md man pages. Authoritative on superblock versions and offsets, chunk size, the symmetric/asymmetric layouts, and the near/far/offset RAID 10 layouts. The --assemble vs. --create distinction in the man page is required reading before you ever touch a Linux array.

Approachable explanations (everyone)

• "Why RAID 5 stops working in 2009" — Robin Harris (StorageMojo / ZDNet). The famous, readable argument that URE rates and growing drive sizes make a RAID 5 rebuild statistically likely to fail. Dated in its specifics, exactly right in its logic — and the clearest possible motivation for RAID 6 and for image-first recovery.
• Vendor "RAID levels explained" primers (with caution). Good for the pictures; sloppy about "stripe size." Read them to fix the layouts visually, then come back here for the vocabulary that keeps you from an off-by-N reconstruction.

In practice (💾 Recovery · 🔍 Examiner · 🛡️ IR · 📜 Legal)

• 💾 ReclaiMe Free RAID Recovery — documentation and the free tool itself. The best teaching aid in the chapter: it isolates parameter discovery. Point it at member images and watch it report order, strip size, parity rotation, and offset.
• 💾🔍 R-Studio and UFS Explorer RAID Recovery manuals. R-Studio's RAID editor (note its synchronous/asynchronous naming for the symmetric/asymmetric layouts) and UFS Explorer's flexible builder (parity delay, nested arrays, Storage Spaces, some ZFS) cover the configurations simpler tools miss.
• 🔍📜 Brian Carrier, File System Forensic Analysis. Not about RAID, but the definitive reference for the NTFS and ext structures you align against when deriving geometry empirically and when verifying a reconstruction.
• 🔍 SNIA Common RAID Disk Data Format (DDF) specification. What hardware controllers write (anchor 0xDE11DE11) — useful when an array has no mdadm superblock to read.

Reference (this book)

• Appendix C — Tool Reference: full entries for R-Studio, UFS Explorer, ReclaiMe, DMDE, and mdadm.
• Appendix J — Practice Images & Lab Setup: how to build, break, and reconstruct a practice RAID safely.
• Appendix A — File Signatures Reference / Appendix G — File-System Reference: the magic numbers and structures you use to confirm a correct geometry.
• Chapter 3 — Storage Technology: RAID/controller/NAS anatomy that this chapter assumes.
• Chapters 8–9 — HDD / SSD Recovery: what you fall back to when a member must be physically resurrected.
• Chapters 6–7 — Logical Recovery / File Carving: run against the reconstructed volume when its file system is also damaged.

Do, don't just read

• Build and break a RAID 5. Create four loop-backed images, mdadm --create an array, copy in files, mdadm --stop, then reconstruct it blind with ReclaiMe (Appendix J). Nothing teaches the six unknowns faster.
• Map a real superblock. Run mdadm --examine on a member image and match every field — Chunk Size, Layout, Data Offset, Device Role, Events — to the six parameters by name.
• Compute parity by hand, then recover. XOR a three-byte stripe to get P, drop one byte, and rebuild it from P and the survivors. Feel why two missing bytes are unsolvable.

Next: Chapter 11 — Mobile Device Recovery: off the platters and into locked, encrypted, soldered-flash phones — a single device that fights you at every layer.