Thursday, 23 May 2013

Computer Forensic : unallocated space and slack space



Unalocated space : Unallocated space, sometimes called “free space”, is logical space on a hard drive that the operating system, e.g Windows, can write to. To put it another way it is the opposite of “allocated” space, which is where the operating system has already written files to. Unallocated space can contain deleted files or partially deleted files.  When a file is deleted, the pointers to the file are removed, but the data remains in unallocated space until such time as the operating system stores another file in the same space, thereby over-writing the data.

Slack space : Slack space refers to portions of a hard drive that are not fully used by the current allocated file and which may contain data from a previously deleted file. Slack space or sometimes referred to as file slack is the area between the end of a fileand end of the last cluster or sector used by the file in question. Slackspace is common in file systems that use a large cluster size, while the file system that uses a small cluster size can organize the storage media more effectively and efficiently. A cluster is the smallest unit of storage that the operating system can deal with. When a file is written, and does not occupy the entire cluster, the remaining space is slack space.

No comments:

Post a Comment