Slack

From ForensicsWiki
Jump to: navigation, search

Definition

In computer forensics slack refers to the bytes after the logical end of a file and the end of the cluster wherein the final byte of the valid file resides.

File Slack Types

RAM Slack

The data storage space that exists from the end of a file to the end of the last sector assigned to a file.

Drive Slack

The data storage space that exists from the end of the last sector assigned to a file to the end of the last cluster assigned to a file.

See Also

External Links