File Slack Handling Tool
Mohamed Alji, Khalid Chougdali · 2021
File slack is the storage space that occurs when a user creates a file that does not occupy over all the space allocated by the file system. It is the product of the file system design. From a digital investigation perspective, this left data may contain forensically relevant information, since the unused space has not overwritten the old data.This document presents the theory behind the file slack and showcases a thorough example of the slack space. An overview of the features of a developed tool is presented. This tool can extract information available in file slack associated with each regular file within the New Technology File System (NTFS) formatted partition. Moreover, it can dump the file slacks in a RAW format and comes with hashing capabilities using MD5 and SHA1 algorithms.