ATTENTION: The new home of the Digital Forensics Wiki is at https://forensicswiki.xyz/. Yeah, it's a silly name, but it was cheap.
This wiki will be going offline permanently in the near future. An exact date will be announced soon. Thank you for being a part of this community.
If you wish to work on the new forensicswiki, please join the Google Group forensicswiki-reborn

Difference between revisions of "Slack"

From ForensicsWiki
Jump to: navigation, search
m
(expanded again)
Line 1: Line 1:
{{Expand}}
 
 
 
== Definition ==
 
== Definition ==
  
In Computer Forensics '''slack''' refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides.
+
In [[computer forensics]] '''slack''' refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides.
  
== Slack Types ==
+
== File Slack Types ==
  
 
=== RAM Slack ===
 
=== RAM Slack ===
  
=== File Slack ===
+
The data storage space that exists from the end of a file to the end of the last sector assigned to a file.
 +
 
 +
=== Drive Slack ===
 +
 
 +
The data storage space that exists from the end of the last sector assigned to a file to the end of the last cluster assigned to a file.
 +
 
 +
== See Also ==
 +
 
 +
* [[FAT#File_Slack]]
  
 
== External Links ==
 
== External Links ==
 +
 +
* http://www.forensics-intl.com/def6.html

Revision as of 11:04, 4 September 2008

Definition

In computer forensics slack refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides.

File Slack Types

RAM Slack

The data storage space that exists from the end of a file to the end of the last sector assigned to a file.

Drive Slack

The data storage space that exists from the end of the last sector assigned to a file to the end of the last cluster assigned to a file.

See Also

External Links