File Slack
Definition
The unused space at the tail of the last cluster of a file. It can contain remnants of whatever previously occupied that cluster, including parts of older deleted files. Examined directly with Autopsy or EnCase.
- Definition
- Unused bytes between the end of a file and the end of its last allocated cluster
- Forensic value
- Contains residual data from deleted files and previous cluster occupants
- Examination tools
- Autopsy, EnCase, and other digital forensics platforms
Common questions
What is file slack and why does it matter in digital forensics?+
File slack is the unused space at the end of a file's last cluster on disk. It matters because it often contains remnants of deleted files or other data that previously occupied that cluster, making it a valuable source of evidence during investigations.
How can you examine file slack during an investigation?+
Forensic tools like Autopsy and EnCase can examine file slack directly. These tools extract and analyze the residual data in the slack space to recover fragments of deleted content.
What kind of data typically shows up in file slack?+
File slack contains whatever was previously stored in that cluster before the current file occupied it. This can include parts of older deleted files or other fragments from past file system activity.
Related terms
- Alternate Data Stream (ADS)
- An NTFS feature that lets a file carry one or more named streams in addition to its default stream, accessed as filename.txt:streamname....
- Hiberfil.sys
- The compressed RAM snapshot Windows writes to C:\ when the system hibernates. Recoverable as a memory image with Hibr2Bin or Volatility, often...
- Journal (File-System)
- A circular log of file-system changes that allows recovery after a crash. NTFS keeps $LogFile, ext3/ext4 keep a dedicated journal block, APFS...
- Kernel Space vs User Space
- Kernel space is the privileged execution mode where the OS schedules processes, drives hardware and enforces memory protection. User space is the...
- LNK File
- A Windows shortcut that records the target path, target MAC times, the source volume serial number, and the MAC address of the...
- MAC Timestamps
- Modified, Accessed, and Changed or Created times. Different file systems use the letters differently: on POSIX it is mtime, atime, ctime (change...
- MBR vs GPT
- Master Boot Record is the legacy partition table at LBA 0, limited to 4 primary partitions and 2 TiB. GUID Partition Table...
- ShellBags
- Registry keys under Software\Microsoft\Windows\Shell\BagMRU and \Bags in UsrClass.dat and NTUSER.DAT that record every folder the user opened in Explorer, including folders on...
- Volume Shadow Copy
- Windows' snapshot mechanism (VSS). Creates point-in-time copies of files and folders. Examiners find shadow copies particularly useful because users rarely know the...
- Volume Shadow Copy (VSS)
- Block-level snapshots of NTFS volumes maintained by the Volume Shadow Copy Service for System Restore and backup. Recoverable with vss-tools, ShadowExplorer, KAPE,...
Explained in these topics
- Operating Systems, Boot Process and File SystemsThe unused space at the tail of the last cluster of a file. It can contain remnants of whatever previously occupied that cluster, including parts of older dele...
- Windows Artifacts II: ShellBags, ADS, LNK, Hibernation, SlackThe unused bytes between the end of a file and the end of the last cluster allocated to it. Carries residual data from whatever previously occupied that cluste...