What is the different between “unused” space and “unallocated” space on a hard drive?
Unused space is an area of the drive that is not formatted and therefore not available for use by the operating system. When a hard drive is first formatted it is 100% “unused”, however after formatting is is normally 99.8% available for use (unallocated) 0.1% in use (allocated) and 0.%1 unused (the area of the hard drive that was not formatted). Note: These numbers are for scale, and are not exacty at all.
As the hard drive is used up the ratio of unallocated/allocated (available for use/in use) changes, however the size of unused space does not change (unless the drive is re-partitioned).
As the operating system, and therefore the user, cannot access the unused section of the hard drive, data cannot be stored there (in normal use). Therefore it is unlikely, but not impossible to find data in this section. However the unused area should always be searched in a forensics investigation, for the following reasons:
- The computer may have been repartitioned and what was important unallocated space, has now been preserved in the unused section.
- The computer may not have been used normally and data has/had been stored there
- Its normally a very small physical size in the “used” area, and therefore there is no disadvantage to searching it. If its not small, then it certainly needs to be searched.