Difference between revisions of "Slack"

From ForensicsWiki
Jump to: navigation, search
m
(expanded again)
 
(One intermediate revision by one other user not shown)
Line 1: Line 1:
{{Expand}}
 
 
 
== Definition ==
 
== Definition ==
  
In Computer Forensics ''slack'' refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides.
+
In [[computer forensics]] '''slack''' refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides.
  
== Slack Types ==
+
== File Slack Types ==
  
 
=== RAM Slack ===
 
=== RAM Slack ===
  
=== File Slack ===
+
The data storage space that exists from the end of a file to the end of the last sector assigned to a file.
 +
 
 +
=== Drive Slack ===
 +
 
 +
The data storage space that exists from the end of the last sector assigned to a file to the end of the last cluster assigned to a file.
 +
 
 +
== See Also ==
 +
 
 +
* [[FAT#File_Slack]]
  
 
== External Links ==
 
== External Links ==
 +
 +
* http://www.forensics-intl.com/def6.html

Latest revision as of 06:04, 4 September 2008

Definition

In computer forensics slack refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides.

File Slack Types

RAM Slack

The data storage space that exists from the end of a file to the end of the last sector assigned to a file.

Drive Slack

The data storage space that exists from the end of the last sector assigned to a file to the end of the last cluster assigned to a file.

See Also

External Links