2Places to hide evidence 4/14/2017Places to hide evidenceEvidence can be hidden in many places within a disk.The notion of “empty space” on a disk is more complicated than you might suspect.The question becomes “what are the different types of empty space?”Unused (bad blocks, deleted file space, network protocol fields)Unallocated space (free space, unused sectors)File slack (unused space at the end of each file)(c) ITT Educational Services, Inc.
3File Collection of Information written to a disk Generally created in an application-specific formatOccupies a fixed number of clustersEach file’s cluster has a pointer to the next cluster in the fileThe final cluster contains the End of File (EOF) marker
4Files Logical File Size Physical File Size File Slack Exact size of contents of file in bytesPhysical File SizeAmount of space a file occupies on disc in bytesFile SlackUnused space between logical end of file and physical end of a clusterTwo types: RAM slack and Disk SlackPhysical File Size<- Logical File Size -><- File Slack ->
5File Slack What does File Slack Contain? Who knows??!! Old data that was deleted but not overwritten yetMay contain remnants of older files, or other evidence includingPasswordsOld directory structuresMiscellaneous information….
6File Slack Example Hello World! Has 12 Characters in the file But occupies 4096 bytes on the disk!
8File Slack Example File Contents: “Hello world!” 12 bytes 3rd Sector Disk Slack:4096 Bytes – 512 Bytes= 3584 BytesRAM slack – to the end of the sectorDISK slack – to the end of the clusterAssumptions:Sector Size = 512 BytesCluster Size = 4KB = 8 Sectors2nd SectorRAM Slack:512 bytes – 12 bytes = 500 bytes
9File Slack Summary RAM Slack Disk Slack Unused space at the end of a sector. Contains information adjacent to the stored information from Main Memory (RAM).Example: The file has only 12 characters, but must write a minimum 512-byte block to the disk – the other 500 characters are whatever happen to be in RAM at the time.Disk SlackUnused space at the end of the cluster. Contains information left over on the disk from prior files.Example: The file system must always write in multiples of clusters (4096 bytes in this case.) The other 3584 bytes (7 sectors) are filled with whatever used to be in the clusters before they were marked for deletion.