What is unallocated space?

What is unallocated space?

Unallocated space, sometimes called “free space”, is logical space on a hard drive that the operating system, e.g Windows, can write to. To put it another way it is the opposite of “allocated” space, which is where the operating system has already written files to.


If the operating system writes a file to a certain space on the hard drive that part of the drive is now “allocated”, as the file is using it the space, and no other files can be written to that section. If that file is deleted then that part of the hard drive is no longer required to be “allocated” it becomes unallocated. This means that  new files can now be re-written to that location.

On a standard, working computer, files can only be written to the unallocated space.

If a newly formatted  drive is connected to a computer, virtually all of the drive space is unallocated space (a small amount of space will be taken up by files within the file system, e.g $MFT, etc). On a new drive the unallocated space is normally zeros, as files are written to the hard drive the zeros are over written with the file data

Working Example

Blank Drive

A freshly formatted (NTFS) 500 GB hard drive starts with 99.9% unallocated space; we will assume its 100% to make the maths slightly easier. All of the unallocated space will be zeros, literally 00 00 00 written on the hard drives.

If a 5 GB file, e.g a large movie, is placed on the drive, then there will be 1% (5 GB)  allocated space and 99% unallocated (495 GB)

If a 10 GB database file is now added to this hard drive there will be a total of 3 % (15 GB) of allocated space and 485 GB unallocated space. New files will only be written into the remaining unallocated space.

What happens when a file is deleted?

If the movie file, from the above example, is deleted the allocated space it was using will now become unallocated. I.e There will now be 2% allocated space (the 10 GB database) and 98% unallocated space.

However the data from the movie file is still on the hard drive, it does not just disappear, it just changes its status. This means that the following situation now exists:

There is 10 GB of allocated space and 490 GB of unallocated space.

Of the 490 GB, 485 GB would be all zeros, however 5 GB of the unallocated space would be the old movie data.

Until new files are written to the hard drive this movie file will remain deleted but still  recoverable from the hard drive. Even if new files are written it must overwrite the same unallocated space as the movie file, before the movie file is destroyed.

Unallocated space can only be accessed by specialist tools, and now directly from Windows. Such tools include:


12 Responses to “What is unallocated space?”

  1. Forensics: Why is there Unallocated Space? « Data - Where is it? Says:

    […] hard drives, once they are formatted, start with unallocated space. In fact in normal use a large part of the  hard drive will be unallocated space  (if you […]

  2. Forensics: Unused and Unallocated « Data - Where is it? Says:

    […] on February 27, 2009 by Rob What is the different between “unused” space and “unallocated” space on a hard […]

  3. Forensics: Recovering Deleted MSGs from PST files « Data - Where is it? Says:

    […] Outlook. Like other Microsoft files, PST files have their own file structure which includes ”unallocated space” from within the […]

  4. saad Says:

    i shrunk my c disk from disk management for a new partition and it was suppose to appear as “unallocated space” (marked in black) so i can turn it into a drive but i didn’t and it took some of the hard disk space aswell
    please anyone help !

  5. raul Says:

    I can not see in my computer “internet explorer” a USB hard drive. It shows the C hard drive but not the USB hard drive. However, when I look in the device manager I am able to see the USB hard drive and it is working properly. There is a lot of data in the USB hard drive which I need to recover. I bought the acronics Disk Director Suite 10 to scan the disk for deleted particions but it can not find any. Your help is greatly appreciated…

  6. Guest Post: Law Firms and Cybersecurity: A Comprehensive Guide for Law Firm Executive Committees - The D&O Diary Says:

    […] in all sectors of any relevant device (including within “deleted recoverable files,” “unallocated and slack space” or the boot sector.) These artifacts can include: Internet addresses; computer […]

  7. Critical Cybersecurity Takeaways From Hillary’s Email Debacle Says:

    […] of: “We have examined thoroughly the email server (including its deleted recoverable files, unallocated and slack space or the boot sector) and we have found no evidence of the remnants, artifacts, or […]

  8. Guest Post: Hidden Lessons from Anthony Weiner’s Laptop (Computer) | The D&O Diary Says:

    […] contents of the “inactive data” on their ESDs, such as data within deleted recoverable files, unallocated and slack space or the boot sector, found during a digital forensic deep dive of a hard […]

  9. Nh Says:

    So is this so companies can secretly spy on conversations?

  10. Overview of Windows Artifacts - Offorensics Says:

    […] $I and $R files are hidden files in the recycling bin. When files get emptied from the recycling bin, they get marked for deletion in the unallocated space of your computer’s HDD. All of the file’s data in unallocated space will be overwritten by other files only when their space is needed. Forensic tools can parse through this area and recover deleted files for you. However, once files are overwritten in unallocated space, not even forensic software can get it back–its gone gone. Unallocated space can get tricky to explain, but I found a good example here. […]

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: