Hard Drives: Cluster

On a standard Windows PC a cluster on a hard drive is comprised of 8 sectors. It is the smallest unit that a file system can address.

The word standard is emphasized here, as there are numerous variations, e.g a RAID attached to a Windows server could have a very different cluster settings. But for for a standard Win 2000/XP with an NTFS file system there is a single hard, the standard is 8 sectors, which is 4 KB.

This means that for a file that is “non-resident data” the smallest physical size it will take up on a hard drive will be 4 KB.

For example if a file is just 2048 bytes long, e.g a text file with 2048 characters, then the file will still be given 4 KB (4096 bytes) of space, as this is 1 cluster and this is the smallest unit that the file system can handle.

Equally if file is 5000 bytes long (i.e just over cluster) it will be allocated 2 clusters – 8 KB.

The remaining space – between the end of the logical file, and the end of the physical space given, e.g between the 2048th btye and the end of 1 cluster, or between the 500th byte and the end of the second cluster is known as “slack”.

Advertisements

3 Responses to “Hard Drives: Cluster”

  1. What is File Slack? | ESI Says:

    […] understand File Slack, one must first understand the basic concepts of Cluster and […]

  2. Forensics: RAM Slack and File Slack « Data - Where is it? Says:

    […] the logical file and the rest of that sector. File Slack is the remaining sectors to the end of the cluster. To put it another way RAM slack is the slack at the byte and sector level. File slack is the […]

  3. What is File Slack « Data - Where is it? Says:

    […] understand File Slack, one must first understand the basic concepts of Cluster and […]


Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s

%d bloggers like this: