Digital Forensics
Private Investigator
Learn More
Contact Us

Slack Space

Milwaukee private investigator explains slack space using bottlesSince computers store information into sectors, and groups of sectors called clusters, it is rare that a file will fit perfectly into the amount of space it is given. The excess space between the end of the file and the unfilled portion of the file's cluster is called slack space. Slack space is considered allocated space by your computer, but does not contain any information about the current file.

Think of several bottles filled to different levels. Each bottle represents a file cluster, and the contents represent file data. The empty space in the bottle above the fill level represents slack space.

When you delete a file from your hard drive, your operating system marks the clusters containing the file as unallocated. This unallocated space is what shows up as “free space” when you check your hard drive’s capacity. However, the contents of the file itself are left intact until a new file overwrites the cluster.

New files may not completely overwrite the old file’s information, which will remain written in the slack space of the cluster. Digital forensic examiners can use a technique called file carving to partially recover deleted file remnants, hoping to piece together the assorted bits and bytes from the slack space into pertinent evidence.


Back To Glossary

Private Investigator Services  |  Digital Forensics  |  Find Out More  |  Contact

Call Us Today 414-377-8207

CONFIDENTIALITY DISCLAIMER All information obtained during the course of an investigation will remain confidential and solely between the investigator, Spindletop Investigations, LLC, and the client. However, private investigators are legally required to report any instances of child pornography or sexual crimes against children. Spindletop Investigations may choose to report other potentially serious crimes if they involve the risk of the loss of life. Spindletop Investigations will not pursue any unrelated leads outside the agreed upon scope of the investigation. As part of the consultation, Spindletop Investigations will work with the client in advance to fully define the scope of the investigation as well as all legal exceptions to our confidentiality agreement.

© Spindletop Investigations. Milwaukee, Wisconsin  |  Site map