Glossary
File slack
The unused space between the end of a file's data and the end of its last allocated cluster, which can hold remnants of earlier files.
File slack is the space left over at the end of a file's last cluster. File systems such as NTFS allocate storage in whole clusters, commonly 4 KB. A 10 KB file therefore occupies three clusters (12 KB), and the final 2 KB after the logical end of the file is slack.
That leftover space is not necessarily empty. When a cluster that once belonged to a deleted file is reused, the new file overwrites only as much as it needs, and the rest of the cluster can still hold fragments of the old content. Investigators therefore search slack for text, document fragments, email addresses or other traces of files that no longer exist.
Slack is often described in two parts:
- RAM slack (or sector slack), from the end of the file to the end of its last sector;
- drive slack, the remaining whole sectors up to the end of the cluster.
Modern Windows versions typically fill the rest of the last sector with zeros, so the recoverable remnants are usually found in drive slack.
Fragments found in slack have no file name or timestamps of their own, so they are hard to attribute to a user or a date. Treat them as leads to corroborate with other artifacts. Slack is only visible in a full disk image, not in a logical copy of the files. See also unallocated space and file carving.