Slack

From Forensics Wiki
Revision as of 06:04, 4 September 2008 by .FUF (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Contents

Definition

In computer forensics slack refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides.

File Slack Types

RAM Slack

The data storage space that exists from the end of a file to the end of the last sector assigned to a file.

Drive Slack

The data storage space that exists from the end of the last sector assigned to a file to the end of the last cluster assigned to a file.

See Also

External Links