Slack Space
Unused bytes inside an allocated filesystem unit that may contain remnants of previously stored data beyond the current logical end of a file.
Digital-Forensics Context
File slack consists of unused bytes inside the final allocated storage unit of a file. Depending on the filesystem, allocation-unit size, and sanitization behavior, those bytes can retain remnants of data that previously occupied the same physical region.
Evidence Boundary
Slack space is different from unallocated space. Slack is inside storage already allocated to a live file beyond its logical end; unallocated space is not currently assigned to an active filesystem object.
Related Digital-Forensics Concepts
- Unallocated Space
- File System
- Disk Image
- Data Remanence