- Introduction: The Whistle-Blower
- Preparation
- Evidence Collection and Chain of Custody
- Drive Imaging
- Review of the Logical File Structure
- Review of Unallocated Space and File Slack
- Smoking Gun
- Reporting
- Lessons Learned
This chapter is from the book
This chapter is from the book
This chapter is from the book
15.6 Review of Unallocated Space and File Slack
After completing the logical file structure review, we focused on analyzing the unallocated space and file slack. Unallocated space, also called free space, is defined as the unused portion of the hard drive; file slack is the unused space that is created between the end-of-file marker and the end of the hard drive cluster in which the file is stored. Sometimes data is written to these spaces that may be of value to investigators.
Using a software tool to facilitate the process is the easiest way to accomplish this portion of the analysis. As we had earlier, we used EnCase for this segment of the review. Our approach was twofold: (1) We extracted deleted files out of the unallocated space and subsequently reviewed them for appropriateness, and (2) we performed string searches through the unallocated space and file slack in an attempt to locate data related to the matter being investigated.
Even with the assistance of software tools, this process can be very time-consuming and potentially lengthy. The results of the extraction of deleted files can be voluminous. In this case several thousand files from each hard drive needed to be reviewed.
In addition, all of the identified files must be reviewed. We can't simply review until we find material that we're looking for, or material that helps our case, and stop. That would an unfair and incomplete evaluation of the potential evidence. Therefore, to expedite the process of reviewing files extracted from unallocated space, we use a software utility called dtSearch. With all of our extracted files in one location, we fed our search terms into dtSearch and had it scan through the files to find those that were pertinent to our investigation.
As in logical file structure review, when potential evidence is found, its address on the hard drive must be recorded. However, because unallocated space and file slack are outside of the logical addressing scheme in this review, we must record the physical address of any evidence, essentially including its cluster and sector address (e.g., cluster 11155, sector 357517).