![]() ![]() Some advanced file deletion and hard drive cleaning utilities provide users with the option to "wipe cluster tips" or "clear slack space." If a file has been deleted this way, any information that remains within the used clusters will be deleted, too. Since the 1kb file only takes up half the space of the original file, it only overwrote the first half. Because the second half of our original file hasn't been overwritten, it's possible, via the use of advanced digital forensics tools, to view the second half of the original 2kb file.Īgain, this is because the original 2kb file was never truly removed from your hard drive - it just appears that way after deletion. The new file takes up the first kilobyte of the cluster - effectively overwriting the first portion of the 2kb file we used in the original example. Now, let's say you've stored a new file that is 1kb in size to that same 4kb cluster. ![]() The data remains in its original location - in this case, it's the first two kilobytes of the 4kb cluster - it's just not visible within your OS. Instead, all of the internal pointers and references to that file are removed. If the file is deleted through traditional means, it's not actually being removed from the hard drive. Taking the example given above of a 4kb cluster and a 2kb file contained within, what happens if we then delete the file in the cluster? The field of digital forensics often analyzes slack space in order to identify past files - or portions of past files - that have since been deleted and, in some cases, written over with new data. Once your slack space grows to several megabytes or gigabytes in space, however, it can have a negative effect on overall performance - not to mention the amount of disk space it requires for storage. This leaves two kilobytes of free space, or slack space, remaining that specific cluster.Īs such, slack space within a few clusters isn't usually a big deal. If a 2kb file is written to this cluster, it only encompasses the first two kilobytes of the cluster. ![]() For example, let's take a computer operating system (OS) that stores data in clusters that are 4kb in size. Slack space, sometimes referred to as cluster tips, is the portion of a hard drive that extends from the end of a complete file and to the end of the file cluster where it is stored. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |