Difference between revisions of "Slack"

From ForensicsWiki
Jump to: navigation, search
m
m (File Slack Types: add hibernation slack)
 
(One intermediate revision by one other user not shown)
Line 1: Line 1:
{{Expand}}
 
 
 
== Definition ==
 
== Definition ==
  
In Computer Forensics '''slack''' refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides.
+
In [[computer forensics]] '''slack''' refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides.
  
== Slack Types ==
+
== File Slack Types ==
  
 
=== RAM Slack ===
 
=== RAM Slack ===
  
=== File Slack ===
+
The data storage space that exists from the end of a file to the end of the last sector assigned to a file.
 +
 
 +
=== Drive Slack ===
 +
 
 +
The data storage space that exists from the end of the last sector assigned to a file to the end of the last cluster assigned to a file.
 +
 
 +
=== Hibernation Slack ===
 +
 
 +
Previous hibernation data that has not yet been overwritten in a hibernation file.
 +
 
 +
== See Also ==
 +
 
 +
* [[FAT#File_Slack]]
  
 
== External Links ==
 
== External Links ==
 +
 +
* http://www.forensics-intl.com/def6.html

Latest revision as of 22:22, 13 November 2017

Definition

In computer forensics slack refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides.

File Slack Types

RAM Slack

The data storage space that exists from the end of a file to the end of the last sector assigned to a file.

Drive Slack

The data storage space that exists from the end of the last sector assigned to a file to the end of the last cluster assigned to a file.

Hibernation Slack

Previous hibernation data that has not yet been overwritten in a hibernation file.

See Also

External Links