Unallocated space

Unallocated space is the part of a volume that the file system considers free. On NTFS, the $Bitmap metadata file tracks which clusters are in use; any cluster marked as free is unallocated.

Deleting a file normally does not erase its content. NTFS marks the file's $MFT record as unused and releases its clusters in $Bitmap, but the data itself stays on disk until something overwrites it. Unallocated space is therefore a major source of deleted documents, images, logs and fragments of old artifacts.

How much survives depends on several factors: how busy the disk is, how long ago the deletion happened, and the storage type. On SSDs, TRIM lets the drive discard freed blocks, so deleted data in unallocated space is often gone much sooner than on spinning disks. Secure deletion tools that overwrite free space have the same effect.

Recovery usually takes two routes. If the MFT record still exists, its data runs point straight to the old clusters. If not, file carving searches the raw space for known file signatures. Either way, content recovered this way often lacks a reliable name, path or timestamps, so it needs corroboration. Unallocated space only exists in a physical or full volume image, which is why logical triage collections cannot capture it. Previous versions of files can also survive in Volume Shadow Copies. See also file slack.