I'm using Autopsy and need to recover a hidden password inside a slack space in another file.
Autopsy shows that each sector for my disk is 512 bytes. The file starts at 4365 of the sector and the file is 677 bytes large. Calculating with 4365 sectors * 512 bytes / sector + 677 bytes = 2,235,557 which should be where my slack space is.
My file that I need to look through doesn't have that big of an offset, and the $Unalloc file has nothing shown when I go to offset 2,235,557.
I'm not sure where I'm supposed to look, the actual existing file, or the $Unalloc file that has deleted contents which has the offset I'm looking for, but has nothing but 0's on that offset.