Digital Forensics
Private Investigator
Learn More
Contact Us

Allocated Space

Allocated and unallocated disc spaceWhen you check your hard drive's storage capacity, everything marked as "used space" is what is also known as allocated space. Because of the nature of sectors and clusters, allocated space may contain many bits and bytes of blank data, or partially-deleted files.

These remnants exist in what's called slack space.

A computer forensics examiner will analyze the slack space within the allocated space in hopes of piecing together relevant scraps of deleted files and assembling them into something meaningful. This detailed process is called file carving.

When your drive writes data to the disc the allocated clusters may be spread out in many different locations. Digital forensics analysts will use several techniques to find as many related file fragments as possible to create the most-complete set of data available.

One common technique is reading the metadata of each file cluster and trying to match that metadata to other groups of clusters.

Back To Glossary

Private Investigator Services  |  Digital Forensics  |  Find Out More  |  Contact

Call Us Today 414-377-8207

CONFIDENTIALITY DISCLAIMER All information obtained during the course of an investigation will remain confidential and solely between the investigator, Spindletop Investigations, LLC, and the client. However, private investigators are legally required to report any instances of child pornography or sexual crimes against children. Spindletop Investigations may choose to report other potentially serious crimes if they involve the risk of the loss of life. Spindletop Investigations will not pursue any unrelated leads outside the agreed upon scope of the investigation. As part of the consultation, Spindletop Investigations will work with the client in advance to fully define the scope of the investigation as well as all legal exceptions to our confidentiality agreement.

© Spindletop Investigations. Milwaukee, Wisconsin  |  Site map