Storage

What is Slack Space? (Explained)

February 10, 2023

In This Article

What is Slack Space?

Slack space, also referred to as file slack on a hard disk drive, denotes the storage space leftover when the computer does not need to use as much space as is allotted to store it.

Technically, this is the space existing between the end of a file stored on the hard drive and the end of that particular file cluster, or allocation block, or memory page, which may contain residual data from an earlier file.

KEY TAKEAWAYS

Slack space is the space between the end of a disk cluster used to store a file and the actual file stored in that specific cluster. It is basically the difference between the logical and physical size of a file stored on the drive.
The slack space plays a significant role in the forensic investigation arena because there can be some vital and meaningful residual data from other smaller files stored within these unused spaces.
File slack is basically a complicated technological issue and a term that is mentioned rarely. It usually occurs naturally due to the variances in the sizes of the file and the cluster it is to be stored in.
The size of the slack spaces on a hard disk may vary since it depends on the size of the files that are stored in a cluster and the size of the cluster itself. It is actually the difference between these two sizes.
These spaces usually occur in the hard disk drive naturally and only in those areas that are already used. The empty spaces in the unused areas on a hard disk drive are called unallocated or free spaces, not slack spaces.

Understanding Slack Space

Typically, in most operating systems, including Windows, the sectors are grouped into a set of four by default. This means that every cluster measures 2048 bytes.

Files on a hard drive are stored in clusters that are allotted by the computer, but the files may not always use up the entire space of the cluster assigned.

Therefore, the space remaining from the end of the file to the end of the cluster stays unused and is called a slack space.

File slack is created naturally due to the functionality of the computer system and unintentional semi-flaws.

It is actually the difference between the logical and physical sizes of a file saved on a hard drive, which are determined as follows:

The logical size is determined by the actual size of the file and is expressed in bytes.
The number of sectors allocated for a file to be stored determines the physical size of a file.

The slack space may not always be empty. For example, in a cluster, if a new file that is smaller than the earlier one is stored, the remaining part of the previous may still be there.

And, there may be some important data stored in there that may help the forensic investigation team. They can extract this data by using specialized forensic tools.

File slack, or slack space is simply a reminder that nothing is deleted from the hard drive of a computer permanently.

Forensic experts can extract and evaluate sensitive data even from the slack spaces that have been created after deleting a file from a specific cluster.

Therefore, it is important to determine which information and data are sensitive enough to keep off digital media. It can be anything basic or ‘more than the basics’ things, such as:

Your business data
Your personal information
Your financial and bank details
A secret formula
Your grandmother’s recipe

However, you should not be scared about it. Looking at it from another point of view, it should relieve you a bit, knowing the fact that the slack spaces indicate that everything in your computer is not lost truly or forever. Sometimes, the data can be recovered.

What Causes Slack Space?

Ideally, a slack space is the result of a practice where a part of the cluster or the space allocated for saving data and information is not used. Ideally, it occurs naturally because the fixed storage allocations can be barely filled up by the data files.

Residual data may sometimes create slack spaces as well when smaller files are written on the same cluster as the earlier larger file.

This leaves a space on the drive and it remains unused. This happens because there is a particular storage threshold for each cluster on a hard disk drive.

And since the files are of random sizes, only a part of the hard drive space is consumed by them, creating slack space.

It ideally happens due to the following reasons:

Each of the clusters on a hard disk drive have different sizes and belong to a single file only, though the files can use as many clusters needed to be saved.
When you delete a file from a particular cluster on your hard drive, it is actually not deleted fully by the operating system. It is simply removed from there.
A new file may be overwritten on that particular cluster that may be smaller in size. In that case the leftover space after saving the file on that cluster will be considered to be the slack space.

Therefore, saving a smaller file in a larger space allocated by the computer creates slack space on the hard disk drive.

What is Slack Space Size?

Simply put, the size of the slack space is not fixed. It may vary depending on two specific factors such as the size of the file to be stored and the amount of space allocated by the computer to save that specific file.

Also, when the hard disk drive of the computer is brand new, the slack space is empty, but it gets reduced when the computer is used.

To have a better understanding regarding the size of a slack space, you will first need to know a few other important things as well, apart from the basic meaning of slack space. These are:

The hard disk drives understand sectors specifically.
According to Logical Block Addressing (LBA), these sectors are almost universally 512 bytes in size.
The operating systems, on the other hand, typically understand clusters or groups of sectors.
The number of sectors may be different depending on the particular file system and the operating system that is used.

This means that the hard disk drives do not understand clusters and the operating systems do not understand sectors. However, both these terms are required to calculate slack space size.

Here are a couple of examples to determine the slack space size.

Example 1

Assume the following:

The sector size is equal to 512 bytes, which is the common sector size.
The cluster size is equal to 8 sectors.
The size of the file to store is equal to 2560 bytes.

Under these circumstances, the smallest amount read or written by the operating system should be 8 sectors or 4096 bytes.

How is Data Hidden in Slack Space?

To hide data in the slack space the physical properties of the entire system and the formatted storage medium as well as the storage capacity are used by the slack space data hiding technology, along with HPA and DCO areas.

Host Protection Area (HPA)

Host Protection Area technology was introduced after the Advanced Technology Attachment 5 (ATA-5) protocol was established. ATA commands are used to protect such areas and store configuration and data files.

These are extremely protected and the data cannot be read by even the operating system or the Basic Input Output System (BIOS)

Device Configuration Overlay (DCO)

Device configuration overlay is a hidden area on the hard disk drive that was introduced for the first time in the ATA-6 standard. It is much stronger than HPA when it comes to hiding data.

The best aspect of it is that it allows the vendors of the systems to buy HDDs of different sizes from different vendors and, later on, configure them so that they have the equal number of sectors.

What is a Slack Space Example?

If a file system can store data on a hard disk drive in clusters of 4 KB, but the computer saves a smaller file using only 2 KB of the cluster, your disk drive will have 2 KB of slack space.

Also, for example, if a cluster of 30 KB is allocated by the computer to save a file, but the operating system stores a file that is ideally 25 KB in size, it will leave 5 KB of space unused.

In this slack space, data from the earlier file may still exist since it could not be overwritten by the current smaller file and will stay there as long as this new file is stored there.

This leftover data, often referred to as ambient data or latent data, provides important clues to the forensic investigators as they probe into the prior questionable use of the computer system in question. This may lead to further examinations.

Slack Space Vs Unallocated Space

Slack space refers to the unused space existing between the ends of a cluster and the actual file. On the other hand, unallocated space refers to the free space existing on a hard drive.
Slack space typically cannot be used to store data, but in comparison, the unallocated or free spaces can be used to hold data.
The unallocated space is a discrete number of clusters, as opposed to slack space.
The slack space is also referred to as file space, while the unallocated space is also referred to as free space.
On the other hand, the deleted files create unallocated space on the hard drive because they are not actually erased fully. On the other hand, slack space is created when only a part of the assigned space for saving information, called the cluster, is used.
The slack space may contain residual data from the earlier files because it exists in used spaces only. On the other hand, unallocated space on a hard drive in a space that has not been used. It usually exists on a new hard disk drive of a computer.
The slack space differentiates between the different clusters on a hard disk. However, in comparison, unallocated spaces typically do not differentiate between the clusters.
All slack spaces are free spaces, but a free space may not necessarily be a slack space.

Is There Slack Space in SSD?

Yes, there are slack spaces on an SSD, but instead of these being a part of cluster and file size alignment, the slack space in an SSD relates to the varied sizes of minimum erasable and writeable blocks on a physical level.

However, the SSD erases the slack space as soon as it has additional I/O capacity.

Conclusion

So, now after you have finished reading this article, you know that when you delete a file from your hard drive, it is not deleted.

You can say it is removed allowing you to have unused space where you can store new files.

If the size of this file is smaller than the previous one, it will create slack space on that cluster.