Redefining File Slack in Microsoft® NTFS

Abstract

This article describes concepts in the Microsoft® NTFS that mask data and create huge areas of slack space. These areas are not visible to applications accessing files through the native operating system; the applications will just see file space with bytes containing zeros. Some computer forensics tools, however, do not distinguish between the data viewable on the disk and data viewable to the owning application. As such, files extracted by computer forensics tools can be different than those viewable by the operating system. This article documents the conditions under which these files can be created, demonstrates a procedure for creating them, highlights how some forensics tools ignore the differences in these files, and makes recommendations to correct the situation.