Difference betwenn Cluster Tips and File-Slack

Oliver222

Oliver222

New Member
Hello,

I am a total newby in this community and have only two questions.

Can anybody tell me what the difference is between cluster-tips und file-slack? Or are both the same?

When I choose "Cleaning unused diskspace" from the options-menue, does that procedure implies also cleaning the file-slack (memory-dumbs etc.?)

thx for any answer,


Oliver
 
AFAIK, file slack refers to both RAM slack and drive slack, and "cluster tips" usually means the latter.

Someone correct me if I'm wrong :wink:
 
Here is my understanding of it. It is a lot easier to draw a picture than to explain with words, but here goes. When a file does not fill up the last cluster (group of sectors) it is using, an incomplete sector is filled in with a bit of what is in RAM, so this part is called RAM slack. The rest of the unused sectors in the cluster are called drive slack, since any info in them is what was written on the drive previously. The combination of the RAM slack and drive slack are called file slack (since it is contiguous unused area, but still associated with the file).

"File slack" and "cluster tip" are the same thing, referring to the unused portion of the incomplete cluster.
 
Do you know if erasing "cluster tips" in Eraser is really erasing all of the cluster tip/file slack? Does it overwrite the RAM slack portion of incomplete sectors (seems impractical) or is it only overwriting the drive slack portion of incomplete clusters?
 
Glenn,

actually that was my question aswell.

I think the difference lies in detail. I am pretty sure a lot of users don´t care much about what actually really is deleted on their system, concerning the option "unused system space" in Eraser.

Under a forensic point of view, as far as I understood it, there are accidental data dumbs by the OS, like virtual memory dumbs out of the ram (Ram-Slack) filling up a the remaining size of a cluster that is already partly occupied by a file and there a remains of previously already deleted files, called Drive-Slack.

Very good definition Gralfus, thanks both of you,


Oliver
 
You must log in or register to reply here.
Back
Top