Unallocated space

Unallocated space is the part of a storage medium that the file system records as free for new data. When a file is deleted, most file systems simply mark its clusters as unallocated and remove the directory reference; the content stays on the medium until new data happens to be written over it. Until then, recovery and forensic tools can often reconstruct deleted files, wholly or partly, by carving that space.

Unallocated space is the main reservoir of data remanence after deletion or a quick format. It differs from slack space, which is the unused tail of clusters still allocated to a live file. Logical deletion leaves unallocated space full of recoverable content, whereas clearing by overwriting, and purging, are designed to remove it. Solid-state drives complicate the picture: TRIM and garbage collection may erase freed blocks on the drive’s own schedule, while wear levelling can leave old copies in cells the host cannot address, so neither recovery nor sanitisation behaves as it does on magnetic disks.

Exam relevance: a scenario is likely to describe deleted files recovered from a drive that was disposed of or reissued. Candidates are expected to explain that deletion only marks space as unallocated, to tell unallocated space from slack space, and to choose sanitisation over deletion or formatting for media leaving the organisation’s control.