What is unallocated space?
Unallocated space, sometimes called “free space”, is logical space on a hard drive that the operating system, e.g Windows, can write to. To put it another way it is the opposite of “allocated” space, which is where the operating system has already written files to.
If the operating system writes a file to a certain space on the hard drive that part of the drive is now “allocated”, as the file is using it the space, and no other files can be written to that section. If that file is deleted then that part of the hard drive is no longer required to be “allocated” it becomes unallocated. This means that new files can now be re-written to that location.
On a standard, working computer, files can only be written to the unallocated space.
If a newly formatted drive is connected to a computer, virtually all of the drive space is unallocated space (a small amount of space will be taken up by files within the file system, e.g $MFT, etc). On a new drive the unallocated space is normally zeros, as files are written to the hard drive the zeros are over written with the file data
A freshly formatted (NTFS) 500 GB hard drive starts with 99.9% unallocated space; we will assume its 100% to make the maths slightly easier. All of the unallocated space will be zeros, literally 00 00 00 written on the hard drives.
If a 5 GB file, e.g a large movie, is placed on the drive, then there will be 1% (5 GB) allocated space and 99% unallocated (495 GB)
If a 10 GB database file is now added to this hard drive there will be a total of 3 % (15 GB) of allocated space and 485 GB unallocated space. New files will only be written into the remaining unallocated space.
What happens when a file is deleted?
If the movie file, from the above example, is deleted the allocated space it was using will now become unallocated. I.e There will now be 2% allocated space (the 10 GB database) and 98% unallocated space.
However the data from the movie file is still on the hard drive, it does not just disappear, it just changes its status. This means that the following situation now exists:
There is 10 GB of allocated space and 490 GB of unallocated space.
Of the 490 GB, 485 GB would be all zeros, however 5 GB of the unallocated space would be the old movie data.
Until new files are written to the hard drive this movie file will remain deleted but still recoverable from the hard drive. Even if new files are written it must overwrite the same unallocated space as the movie file, before the movie file is destroyed.
Unallocated space can only be accessed by specialist tools, and now directly from Windows. Such tools include:
February 25, 2009 at 8:58 pm
[…] hard drives, once they are formatted, start with unallocated space. In fact in normal use a large part of the hard drive will be unallocated space (if you […]
February 27, 2009 at 9:06 am
[…] on February 27, 2009 by Rob What is the different between “unused” space and “unallocated” space on a hard […]
April 2, 2009 at 11:25 am
[…] Outlook. Like other Microsoft files, PST files have their own file structure which includes ”unallocated space” from within the […]
December 1, 2009 at 7:14 pm
i shrunk my c disk from disk management for a new partition and it was suppose to appear as “unallocated space” (marked in black) so i can turn it into a drive but i didn’t and it took some of the hard disk space aswell
please anyone help !
July 16, 2010 at 5:36 pm
I can not see in my computer “internet explorer” a USB hard drive. It shows the C hard drive but not the USB hard drive. However, when I look in the device manager I am able to see the USB hard drive and it is working properly. There is a lot of data in the USB hard drive which I need to recover. I bought the acronics Disk Director Suite 10 to scan the disk for deleted particions but it can not find any. Your help is greatly appreciated…
February 13, 2015 at 2:58 pm
[…] Where is your data, “What is unallocated space?” Available at: https://whereismydata.wordpress.com/2008/10/03/what-is-unallocated-space/ […]
April 13, 2016 at 11:56 pm
[…] in all sectors of any relevant device (including within “deleted recoverable files,” “unallocated and slack space” or the boot sector.) These artifacts can include: Internet addresses; computer […]
July 15, 2016 at 4:19 pm
[…] of: “We have examined thoroughly the email server (including its deleted recoverable files, unallocated and slack space or the boot sector) and we have found no evidence of the remnants, artifacts, or […]
November 8, 2016 at 3:29 am
[…] contents of the “inactive data” on their ESDs, such as data within deleted recoverable files, unallocated and slack space or the boot sector, found during a digital forensic deep dive of a hard […]
January 19, 2018 at 4:51 pm
So is this so companies can secretly spy on conversations?
August 21, 2018 at 6:39 pm
N- its just how hard drives work
February 13, 2020 at 11:37 pm
[…] $I and $R files are hidden files in the recycling bin. When files get emptied from the recycling bin, they get marked for deletion in the unallocated space of your computer’s HDD. All of the file’s data in unallocated space will be overwritten by other files only when their space is needed. Forensic tools can parse through this area and recover deleted files for you. However, once files are overwritten in unallocated space, not even forensic software can get it back–its gone gone. Unallocated space can get tricky to explain, but I found a good example here. […]