Slack space

Slack space is storage inside an allocated unit that the current file does not use. File systems allocate space in whole clusters, so a file that ends partway through its last cluster leaves the rest of that cluster unused. Whatever was stored there before, such as part of a previously deleted file, can remain until something overwrites it. Forensic texts commonly divide it into RAM slack, from the end of the file to the end of its last sector, and drive slack, the unused sectors that follow within the same cluster.

Slack space is one of the places where data remanence persists. It differs from unallocated space, which is clusters the file system has marked as free; slack is the unused tail of clusters still assigned to a live file. Wiping individual files can leave slack untouched, so sanitising the whole medium by clearing, purging or destruction under NIST SP 800-88 is the stronger approach. Slack can also hide data concealed on purpose.

Exam relevance: a scenario is likely to describe fragments of old data recovered from a drive believed to be clean, or to contrast deleting files with sanitising media. Candidates are expected to recognise slack as residual data within allocated clusters, to tell it apart from unallocated space, and to prefer media-level sanitisation to file deletion.