When you check your hard drive's storage capacity, everything marked as "used space" is what is also known as allocated space. Because of the nature of sectors and clusters, allocated space may contain many bits and bytes of blank data, or partially-deleted files.
These remnants exist in what's called slack space.
A computer forensics examiner will analyze the slack space within the allocated space in hopes of piecing together relevant scraps of deleted files and assembling them into something meaningful. This detailed process is called file carving.
When your drive writes data to the disc the allocated clusters may be spread out in many different locations. Digital forensics analysts will use several techniques to find as many related file fragments as possible to create the most-complete set of data available.
One common technique is reading the metadata of each file cluster and trying to match that metadata to other groups of clusters.
Back To Glossary