Glossary term
Slack Space
Slack space is the unused portion of a disk cluster after a file's content ends. Because file systems allocate clusters in fixed sizes, the leftover bytes often contain residual data from previously deleted files.
File systems organize storage in clusters (typically 4 KB or larger). When a file is smaller than the cluster, the remainder of the cluster is unused from the file system's perspective but still contains whatever data was in that cluster previously.
For forensic purposes, slack space is a rich source of residual evidence. Deleted file content, encryption keys, browser cache fragments, and transient OS data can all survive in slack space well after the user has deleted the original.
Modern SSDs with TRIM enabled erase slack space more aggressively than traditional hard drives, which complicates recovery. Whole-disk encryption also reduces slack-space recoverability because losing the encryption key effectively destroys the entire encrypted volume's contents, including slack.