Slack space refers to the storage area of a hard drive ranging from the end of a stored file to the end of that file cluster.

In typical hard drives, the computer stores files on the drive in clusters of a certain file size. For example, the file system on the hard drive may store data in clusters of four kilobytes. If the computer stores a file that is only two kilobytes in a four kilobyte cluster, there will be two kilobytes of slack space.

Slack space is an important form of evidence in the field of forensic investigation. Often, slack space can contain relevant information about a suspect that a prosecutor can use in a trial. For example, if a user deleted files that filled an entire hard drive cluster, and then saved new files that only filled half of the cluster, the latter half would not necessarily be empty. It may include leftover information from the deleted files. This information could be extracted by forensic investigators using special computer forensic tools.

Hard drive terms, Security terms, Storage device

  • How to make sure all data is erased on a computer hard drive.
  • How to be anonymous on the Internet.
  • Hard drive help and support.