Slack Space

Slack space is harddisk portions not fully used by the current allocated file, and containing data from a previously deleted file.

The example save a 768 bytes file (User_File.txt) that requires only sector 1 and 1/2 sector 2.  Depending on the operating system, the 256 bytes in sector 2 might be filled with 1′s or 0′s .  Sectors 3 and 4 would not be overwritten and considered slack space.  If the slack space contained data from a deleted file previously, the information could be recovered with forensic tools. Details of operating systems allocate files on the harddisk using clusters (a collection of contiguous sectors).  The operating system can address because a cluster is a smaller allocation unit. If a file does not utilize the full cluster, the space remaining portion  might not be overwritten and might contain data from a previously deleted file. It is important to understand that slace space is considered allocated space since it is part of an allocated cluster.