Thursday, 23 May 2013
Computer Forensic : unallocated space and slack space
Unalocated
space : Unallocated space, sometimes called “free space”, is logical space on a
hard drive that the operating system, e.g Windows, can write to. To put it
another way it is the opposite of “allocated” space, which is where the
operating system has already written files to. Unallocated space can contain deleted
files or partially deleted files. When a
file is deleted, the pointers to the file are removed, but the data remains in
unallocated space until such time as the operating system stores another file
in the same space, thereby over-writing the data.
Slack
space : Slack space refers to portions of a hard drive that are not fully used
by the current allocated file and which may contain data from a previously
deleted file. Slack space or sometimes referred to as file slack is the area
between the end of a fileand end of the last cluster or sector used by the file
in question. Slackspace is common in file systems that use a large cluster
size, while the file system that uses a small cluster size can organize the
storage media more effectively and efficiently. A cluster is the smallest unit
of storage that the operating system can deal with. When a file is written, and
does not occupy the entire cluster, the remaining space is slack space.
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment