Digital Forensics
Private Investigator
Learn More
Contact Us


Western Digital hard drive forensic examinationSectors are the smallest containers computers will use to store data. Your operating system will group sectors together into clusters, which helps speed up the read and write process. Each sector holds up to 512 kilobytes of data.

When the operating system saves a file to the hard drive, it will mark the entire cluster as used, or allocated, even if the file being saved is less than the size of one sector. The difference between the allocated space and the space the files actually takes up is called slack space.

Think of a sector like using a 4-gallon bucket to store liquids:

10 ounces of water + 60 ounces of motor oil + 58 ounces of milk = 1 gallon of liquid

However, you probably wouldn’t want to store them all in the same container. In order to keep them from contaminating one another you need to use 12 gallons of total storage space.

Those 11 extra gallons of space are allocated to the liquids the buckets are holding, even though there is only a fraction of storage space being used by each.

In order to recover a deleted file, computer forensics examiners need to have an understanding of how hard drives arrange data.


Back To Glossary

Private Investigator Services  |  Digital Forensics  |  Find Out More  |  Contact

Call Us Today 414-377-8207

CONFIDENTIALITY DISCLAIMER All information obtained during the course of an investigation will remain confidential and solely between the investigator, Spindletop Investigations, LLC, and the client. However, private investigators are legally required to report any instances of child pornography or sexual crimes against children. Spindletop Investigations may choose to report other potentially serious crimes if they involve the risk of the loss of life. Spindletop Investigations will not pursue any unrelated leads outside the agreed upon scope of the investigation. As part of the consultation, Spindletop Investigations will work with the client in advance to fully define the scope of the investigation as well as all legal exceptions to our confidentiality agreement.

© Spindletop Investigations. Milwaukee, Wisconsin  |  Site map