Difference between revisions of "Slack"
From Forensics Wiki
(New page: {{Expand}} == Definition == In Computer Forensics 'slack' refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides. ...) |
(expanded again) |
||
| (2 intermediate revisions by one user not shown) | |||
| Line 1: | Line 1: | ||
| − | |||
| − | |||
== Definition == | == Definition == | ||
| − | |||
| − | + | In [[computer forensics]] '''slack''' refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides. | |
| − | + | == File Slack Types == | |
| − | + | ||
| + | === RAM Slack === | ||
| + | |||
| + | The data storage space that exists from the end of a file to the end of the last sector assigned to a file. | ||
| + | |||
| + | === Drive Slack === | ||
| + | |||
| + | The data storage space that exists from the end of the last sector assigned to a file to the end of the last cluster assigned to a file. | ||
| + | |||
| + | == See Also == | ||
| + | |||
| + | * [[FAT#File_Slack]] | ||
== External Links == | == External Links == | ||
| + | |||
| + | * http://www.forensics-intl.com/def6.html | ||
Latest revision as of 06:04, 4 September 2008
Contents |
[edit] Definition
In computer forensics slack refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides.
[edit] File Slack Types
[edit] RAM Slack
The data storage space that exists from the end of a file to the end of the last sector assigned to a file.
[edit] Drive Slack
The data storage space that exists from the end of the last sector assigned to a file to the end of the last cluster assigned to a file.
