Slack Space
Slack Space
Ungenutzter Restbereich von Speicherblöcken
Slack space is the unused room between the end of a file and the end of the last storage block it occupies. Because storage is allocated in fixed block sizes, a remainder almost always stays — and this remainder can contain fragments of earlier data. For forensics it is an often overlooked treasure trove.
History & facts. If a file occupies a block only partially, the block is nonetheless reserved in full; in many file systems the unwritten remainder retains the contents that were there before. Thus remnants of deleted files can survive in slack space long after the file system has recorded them as removed. This is precisely what makes it valuable for investigation — and at the same time a possible hiding place, for instance within anti-forensic techniques.
Outlook & recommendation. Slack space is captured only when work is done forensically correctly: a bit-precise image preserves it too, a normal file copy does not. For the defence it follows that „delete“ does not mean „disappear“ — those who want to remove data securely must actually overwrite the occupied space (wiping). For investigators, slack space is a valuable source precisely because it is often disregarded.