Understanding Slack space vs unallocated for file storage

Many consumers using data storage devices are unaware of the difference between what is called "slack" space and unallocated space for storage. When you delete a file from a device, storage space is freed up and as the user, it appears that you no longer have access to it. However, this is not the case and it is important for users to understand, especially if you are looking to recover lost data.

What are slack spaces?

“The files on your hard drive are organised into clusters. Their sizes vary depending on the file system you use — for example, in NTFS clusters are usually 4kB. Each cluster can only belong to one file (but a file can utilise as many clusters as it needs). So if a file is 12kB, it will be stored in three clusters, and each of those clusters will be completely written with its data. If you then delete that file, and a new file of 9kB overwrites it, that file will also spread out over three clusters, but the third one of those will only have 1kB of its data overwritten. The remaining 3kB will create a slack space, which is a string of data from a previous file that hasn’t been overwritten and that still physically exists on the disc (and because the entire cluster is reserved for the new file, this data will not be overwritten for as long as this new file exists)”.

Robin England from the Data Recovery Lab at Ontrack

Therefore, waiting for your files to become naturally overwritten creates so-called slack spaces where traces of data about old user files continue to exist.

IMPORTANT: Data stored within slack spaces could be used to recover your logins and passwords, parts of your files, communications (for example your instant messenger archives) and many other traces that could lead to more interesting information about you. All it takes is a little know-how, some experience and the right tools (many of which are actually quite easy to use).

Real life example of slack spaces recovering files

A few months ago, my friend had mistakenly deleted some photos from her SD card, so I encouraged her to try out some data recovery software. She was very surprised to find not only the pictures that she’d deleted, but also some very old ones — including her parents’ holiday pictures from when they used the SD card with their own camera.

Reasons NOT to wait for files to be naturally overwritten

It might take a lot of time — especially if your drive has a lot of storage
You will never have full certainty of where your data physically exists, so you won’t know if a sensitive file that you’ve deleted doesn’t still exist somewhere as a partial copy or a trace
If you’re planning to sell your used equipment or your company’s old machines, you won’t have time to wait until all sensitive data has been overwritten
Some sectors of your disc drive get damaged as you use them (their locations on the disk are mapped in a place called the G-list), and they become unwritable — as I mentioned before, the same principle goes for all flash memory drives. Naturally, you can’t overwrite data within an unwritable sector, but that doesn’t mean that you can’t read it — all you need is the right software

More about:

Ontrack for data recovery services

Share Print Page

By Device

By Solution

By Industry

Data Recovery

Tape Services

Data Destruction

Other Services

Ontrack EasyRecovery

Ontrack PowerControls

Data Erasure Software

Data Erasure Hardware

Ontrack Partners

Technology Partners

Technology Partners