what is slack space
Forensic Basics - Slack Space Slack space is the unused space between the end of the actual file and the end of the the defined data unit (cluster). A cluster is the smallest unit of storage that the operating system can deal with. When a file is written, and does not occupy the entire cluster, the remaining space is slack space. For example, assume that the OS uses a 4k cluster and 512 byte sector, meaning it writes data in 4k increments made up of eight 512 byte sectors, regardless of the actual size of the file being written. This means that if a 2000 byte file were written to this cluster the remaining 2096 bytes would be slack.