Difference between revisions of "Slack"
From Forensics Wiki
Uwe Hermann (Talk | contribs) m |
(expanded again) |
||
| (One intermediate revision by one user not shown) | |||
| Line 1: | Line 1: | ||
| − | |||
| − | |||
== Definition == | == Definition == | ||
| − | In | + | In [[computer forensics]] '''slack''' refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides. |
| − | == Slack Types == | + | == File Slack Types == |
=== RAM Slack === | === RAM Slack === | ||
| − | === | + | The data storage space that exists from the end of a file to the end of the last sector assigned to a file. |
| + | |||
| + | === Drive Slack === | ||
| + | |||
| + | The data storage space that exists from the end of the last sector assigned to a file to the end of the last cluster assigned to a file. | ||
| + | |||
| + | == See Also == | ||
| + | |||
| + | * [[FAT#File_Slack]] | ||
== External Links == | == External Links == | ||
| + | |||
| + | * http://www.forensics-intl.com/def6.html | ||
Latest revision as of 06:04, 4 September 2008
Contents |
[edit] Definition
In computer forensics slack refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides.
[edit] File Slack Types
[edit] RAM Slack
The data storage space that exists from the end of a file to the end of the last sector assigned to a file.
[edit] Drive Slack
The data storage space that exists from the end of the last sector assigned to a file to the end of the last cluster assigned to a file.
