Slack Space Question 2

[snorkel]

This is to settle a bet, so a URL would be helpful with an answer if possible. Ok - data is copied from old HDD in PC to brand new hard drive on laptop for temporary storage.

New hard drive is inserted in PC and Windows is loaded. Data is copied back from laptop to new hard drive in PC.

Question - Is slack space data copied along with files to the laptop HDD and then back to the new HDD or is it left or all the files copied "clean" of slack space data??

In a nutshell, I'm asking if any legacy data creeps over along with a file copy due to the data in slack file space.

Thanks!!

 

[mainegeek]

snorkel,

Simple copying will not copy slack space.

http://www.developer.com/tech/article.php/600491

 

[eyec]

i agree with mainegeek.

however, bit image copying will copy slack space.

 

[paparazi]

Slack space" I love it! a new term.
Just the files are copied but.... obviously if within those files you have crap.. that will get copied as well.

No "slack space" will get copied but it might help to spend some time tidying those files up before copying across.

It would also be advisable to scan the file for any viruses once cleaned and ready to be copied.
Besides, cleaning the files helps to evaluate just what you need to keep.



Martin

We like members to GIVE and not just TAKE.
Participate and help others.

 

[edfair]

All of the files copied will generate their own clean new slack space leaving all the garbage in the old drive's slack space behind.

The file copying will end at the file size stored in the directory.



Ed Fair
Give the wrong symptoms, get the wrong solutions.

 

[eyec]

new term?

http://en.wikipedia.org/wiki/Slack_space

 

[snorkel]

Thanks to all that answered - this wins me the bet. I said that if you were trying to hide what you were doing, you could use this method (copying to fresh drive) to cover your tracks. My buddy said that slack space was copied along with a simple file copy so it pointless to do a copy.

Sometimes I'm actually right.

 

[eyec]

I said that if you were trying to hide what you were doing, you could use this method (copying to fresh drive) to cover your tracks.

it seems that his was not really a HD issue but more of an (anti-)forensics issue.

i feel so used

 

[Grenage]

new term?

Hitherto, I'd never heard this term used, either.

I said that if you were trying to hide what you were doing, you could use this method (copying to fresh drive) to cover your tracks.

If you had got to the point where you were considering swapping out the drives to cover your tracks, I think it's safe to say that you'd have to set fire to the computer.

Carlsberg don't run I.T departments, but if they did they'd probably be more fun.

 

[snorkel]

Sorry if anyone feels used or if this was the wrong place to post this question. This is what happens when two people start talking about a meaningless issue and then refuse to let it go. Sort of like geek bravado, if there is such a thing.

 

[Grenage]

Well it was technically disk-related.

Carlsberg don't run I.T departments, but if they did they'd probably be more fun.

 

[edfair]

Slack came into prominence with the large drives and FAT16 forcing 4, then 8, then 16 , then 32K clusters. Where the ability to build big drives outran the operating system's capability to manage them efficiently.

So far as hiding stuff, the detrius of deleted files could show some of what had previously been stored but the reassignment of clusters with further use would effectively reduce recoverable data to fragments.

Although some might take issue with the thread it led to new learning for several regular posters so in that respect it was valuable. Have no regrets.

Ed Fair
Give the wrong symptoms, get the wrong solutions.