Comments on: File Slack Vs RAM Slack Vs Drive Slack

By: Jibran

Jibran — Sat, 24 Apr 2010 13:44:04 +0000

very helpful

By: Resposta Quiz Forense: Fake Stego :) – Slack Spaces « Foren6

Resposta Quiz Forense: Fake Stego :) – Slack Spaces « Foren6 — Thu, 01 Apr 2010 20:51:44 +0000

[...] File Slack Vs RAM Slack Vs Drive Slack Publicado em Quiz. Tags: cluster, file slack, qr code, slack space. Deixar um comentário » [...]

By: Pradnya

Pradnya — Sun, 11 Mar 2007 08:06:01 +0000

Explained in a simple and humorous way independent of all the intimidating technical jargon!!!

By: James S

James S — Thu, 26 Oct 2006 04:33:30 +0000

Excellent explanation. This is always something that I’ve had a hard time understanding. Now it makes perfect sense.

By: M S

M S — Thu, 06 Jul 2006 12:55:52 +0000

Well gud one…. But i think in windows the size of file is also depends on the Cluster size,which is nothing but number of sectors per cluster.For example in Windows Xp default cluster size is 4K which means that 8 sectors per cluster…that’s why when we r creating any file then minimum size of disk is 4K…

By: Neil Broom

Neil Broom — Sat, 24 Jun 2006 03:01:23 +0000

It is important to note that RAM Slack on a Windows system does NOT write data from memory in current OSes and hasn’t since the release of Windows NT. Instead Windows simply pads out the end of the sector with 0s.

Also, the definition given for “Drive Slack” is actually the term most often associated with the term “File Slack”. Drive Slack is not an expression normally used. File Slack is located in the unused sectors at the end of the cluster.

By: Rob Pearson

Rob Pearson — Fri, 23 Jun 2006 13:27:05 +0000

Very Nice!.. A Very Basic Topic, yet ESSENTIAL in forensics, put forth in a nice simple way..

Rob

By: Kush Wadhwa

Kush Wadhwa — Wed, 21 Jun 2006 20:47:39 +0000

Fantastic Article!!!! Superb! Modifying the chunk size is very easy in case of linux. Please tell how to play with chunk sizes in Windows operating system.