What is File Slack

What is File Slack?

This article looks at file slack, where it is, how to find it? Below is a video guide of how to view slack data in EnCase 6.10. For  more detailed information on File Slack see this article


To understand File Slack, one must first understand the basic concepts of Cluster and Sectors.

File Slack

File slack, in short is what the name implies; it is the “slack”/ the spare bit at the end of a file.

Technically it is the difference between the physical file size and logical file size. The physical size is always the same or greater than the logical size. If the physical size is greater in size than the logical file then the spare data between between the logical and physical file is known as “slack”.

File slack is slightly different to RAM Slack


4 Responses to “What is File Slack”

  1. Forensics: Deleting and Wiping Data « Data - Where is it? Says:

    […] takes up just a few characters and would easily fit into a single sector, for example the file slack of an active […]

  2. sandrar Says:

    Hi! I was surfing and found your blog post… nice! I love your blog. 🙂 Cheers! Sandra. R.

  3. Anonymous Says:

    thanks. I know the basics of file-slack.

  4. Rahul Says:

    Very nicely described, good basics.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: