Presentation is loading. Please wait.

Presentation is loading. Please wait.

File Slack Summary Computer Forensics BACS 371. Places to hide evidence  Evidence can be hidden in many places within a disk.  The notion of “empty.

Similar presentations


Presentation on theme: "File Slack Summary Computer Forensics BACS 371. Places to hide evidence  Evidence can be hidden in many places within a disk.  The notion of “empty."— Presentation transcript:

1 File Slack Summary Computer Forensics BACS 371

2 Places to hide evidence  Evidence can be hidden in many places within a disk.  The notion of “empty space” on a disk is more complicated than you might suspect.  The question becomes “what are the different types of empty space?”

3 File  Collection of Information written to a disk  Generally created in an application-specific format  Occupies a fixed number of clusters  Each file’s cluster has a pointer to the next cluster in the file  The final cluster contains the End of File (EOF) marker

4 Files  Logical File Size  Exact size of contents of file in bytes  Physical File Size  Amount of space a file occupies on disc in bytes  File Slack  Unused space between logical end of file and physical end of a cluster  Two types: RAM slack and Disk Slack Physical File Size

5 File Slack  What does File Slack Contain?  Who knows??!!  Old data that was deleted but not overwritten yet  May contain remnants of older files, or other evidence including Passwords Old directory structures Miscellaneous information ….

6 File Slack Example Hello World! Has 12 Characters in the file But occupies 4096 bytes on the disk!

7 File Slack Example

8 File Contents: “Hello world!” 12 bytes 2 nd Sector 3 rd Sector RAM Slack: 512 bytes – 12 bytes = 500 bytes Disk Slack: 4096 Bytes – 512 Bytes = 3584 Bytes Assumptions: Sector Size = 512 Bytes Cluster Size = 4KB = 8 Sectors

9 File Slack Summary  RAM Slack  Unused space at the end of a sector. Contains information adjacent to the stored information from Main Memory (RAM).  Example: The file has only 12 characters, but must write a minimum 512-byte block to the disk – the other 500 characters are whatever happen to be in RAM at the time.  Disk Slack  Unused space at the end of the cluster. Contains information left over on the disk from prior files.  Example: The file system must always write in multiples of clusters (4096 bytes in this case.) The other 3584 bytes (7 sectors) are filled with whatever used to be in the clusters before they were marked for deletion.


Download ppt "File Slack Summary Computer Forensics BACS 371. Places to hide evidence  Evidence can be hidden in many places within a disk.  The notion of “empty."

Similar presentations


Ads by Google