Random data in drive sectors. This is data beyond the actual data of a file. "Ram slack" is used to fill the unused portion of the last sector of a file, and "drive slack" is whatever is in any unused sectors of the last cluster. See http://www.forensics-intl.com/def6.html
If you found something useful today, please consider a small donation.
Got something to add? Send me email.
More Articles by Tony Lawrence © 2011-07-07 Tony Lawrence
If you just want to use the system, instead of hacking on its internals, you don't need source code. (Andrew S. Tanenbaum)