The slack space is the unused space at the end of a not completely used sector of the filesystem. Slack spaces arise at the end of a file or when a file is smaller then the sector size of the filesystem.
Questions tagged [slack-space]
5 questions
3
votes
2 answers
Uncover data in file slack
Today in class we learned about how information can be uncovered in a file slack. I understand this theoretically, given the physical and logical file size I can come up with the slack space of a file. However, how can I uncover this information in…
Bthegreatest
- 31
- 1
- 1
- 3
2
votes
1 answer
Autopsy uncovering slack space of a file
I'm using Autopsy and need to recover a hidden password inside a slack space in another file.
Autopsy shows that each sector for my disk is 512 bytes. The file starts at 4365 of the sector and the file is 677 bytes large. Calculating with 4365…
hicu0
- 21
- 1
- 2
0
votes
1 answer
Recover UTF16 Strings from Slack Space
Using the disk image provided by the CFReDS project here, we are tasked with recovering deleted text, much in Russian, some in English, in UTF16BE. In the allocated space, this goes relatively quickly using fls and icat.
However, some data seems to…
d-cubed
- 105
- 5
0
votes
2 answers
How likely is it to find valuable information in the slack space of a workstation?
I just read about slack space which is the unused space at the end of a sector. This space is unused in some sectors when either the file itself is smaller then the sector or the sector contains the end of a file, which is likely to not fill the…
davidb
- 4,285
- 3
- 19
- 31
-1
votes
1 answer
Can Zip files contain any information other than the bytes in the files being zipped?
We have a secure environment where we sometimes transfer large quantities of unclassified data between machines certified for classified operations. We zip these files to ease the process of data transfer. A concern has been raised about these zip…
Robert Harvey
- 188
- 10