Differentiate between slack space and unallocated space and explain why both matter in forensics.

• A. Slack space is unused portions within a cluster; unallocated space is space not assigned to any file; both may contain remnants and hidden data
• B. Slack space refers to data mistakenly overwritten by new files, while unallocated space is data that still exists in clusters
• C. Slack space and unallocated space are the same thing
• D. Slack space is storage for metadata; unallocated space stores system files

Answer: (B)

Slack space is the unused portion of the last cluster allocated to a file—the bytes at the end of that cluster that the file doesn’t actually use. Because clusters are fixed in size, a file may end partway through a cluster, leaving behind leftover data. That leftover can contain remnants from the file’s previous contents or other hidden data, making it a potential source of evidence.

Unallocated space is the part of the disk the filesystem marks as free, not currently assigned to any file. It isn’t active storage for files, but it can still hold data remnants from deleted files or prior writes, which forensic analysis can sometimes recover or interpret.

Both matter in forensics because they can preserve information that isn’t visible in the file system’s active files. Slack space can contain traces related to a specific file, while unallocated space can reveal deleted content or other artifacts. The distinction is that slack space is the leftover within an allocated cluster, whereas unallocated space is free space not currently allocated to any file.