0704 Slack Space And Swap File

Summary (Technological concepts & key details)

Slack space (NTFS / file system allocation behavior)

• Even when a file is small (e.g., 1.57 KB), the file system allocates disk space in clusters/blocks (example: Windows uses 4 KB clusters).
• This creates slack space—allocated space that is not actually used by the file’s contents.
• The unused portion can sometimes contain residual/implicit data that may be analyzable.

Hex / low-level inspection using a hex editor (Windex)

• Uses a hexadecimal editor (Windex) to scan a raw disk/drive and inspect filesystem structures.
• The example inspection includes details such as:
  • disk offset (e.g., 0 offset),
  • a human-readable view,
  • filesystem type (NTFS),
  • free space status (e.g., 61% free),
  • cluster number information.
• Demonstrates with a file (sample.txt) from a prior lesson about Alternate Data Streams (ADS):
  • the file shows an “hidden” ADS,
  • it also illustrates slack space within allocated regions (unused bytes between expected content or within allocated gaps).

Collecting slack space / free space for analysis

• Mentions a process/tool option to collect slack space from the whole drive into one consolidated file stored elsewhere (example: a USB stick).
  • This can enable forensic digging for information remaining in slack space.
  • Note: collecting slack space may require large external storage.
• Also discusses gathering free space:
  • Free space may still contain data from previously deleted files that hasn’t been fully overwritten.
  • Collecting free space can help attempts to reconstruct deleted content.

Other overlooked filesystem artifacts

• Hibernation file: hiberfil.sys
  • Used for system hibernation by writing physical memory to disk so the system can resume with RAM state restored.
  • May contain sensitive memory snapshots.
• Page file: pagefile.sys
  • Used for virtual memory / swapping, storing parts of program memory when RAM is insufficient.
  • Can contain artifacts from previously running programs, useful in forensics.
  • Effect depends on whether the system is configured to clear the page file on shutdown.
  • Example: recognizable strings may appear in the page file (e.g., identifiers and architecture-related values like AMD64, processor info).

Security / forensics relevance

• Locations like slack space, free space, hibernation, and page files are often overlooked during normal user activity.
• Malicious actors may hide or store data there to evade standard browsing and expectations.

Main speakers/sources

• The video narrator/instructor (no specific person named in the subtitles).