January 07, 2016

[Forensic] Drive Slack

□ Drive Slack

○ Summary : Wasted space of cluster(Sector unit).
○ Example : 1025Bytes data = 3 Sectors(512Bytes + 512Bytes + 1Byte) use → 5 Sectors(512Bytes * 5) waste
○ Feature : Data in wasted space is left. It is not deleted.
※ Standard : 1 Cluster == 8 Sectors == 512KB * 8 == 4096KB