Re: Does Windows 2000 through present copy slack space?

Tech-Archive recommends: Repair Windows Errors & Optimize Windows Performance

From: Chris Drury (ChrisDrury_at_discussions.microsoft.com)
Date: 09/01/04 

Date: Wed, 1 Sep 2004 07:35:09 -0700

That is indeed what I'm talking about, thanks Bjorn. From what I've been
able to test with a floppy disk, not only does the system not copy the slack
space from the origin, but it also overwrites the destination slack space (at
least in the current sector, if not the cluster). I'm still trying to learn
about how the files are stored and how the sectors and clusters are used in
the file system, but I'm getting there.

Thanks again for your reply.

chris

"Bjorn Landemoo" wrote:

> Chris
>
> I assume that you by slack space mean the unused space in a cluster that is
> reserved for a file but not used.
>
> Slack space is not part of the file, so it won't be copied. However, the
> recieving file system also has slack space, so you will find that you have
> slack space there as well.
>
> How much slack space depends on cluster size, and file size.
>
> Best regards
>
> Bjorn
> --
> Bjorn Landemoo - mvp2@landemoo.com - http://landemoo.com/
> Microsoft MVP (Windows Server - File System)
>
> "Chris Drury" <Chris Drury@discussions.microsoft.com> wrote:
>
> >I'm trying to determine if versions of Windows from 2000 through 2003 copy
> >the slack space at the end of a file when doing a normal file->copy command
> >(either from gui or command line). I've tested (with a hex editor program)
> >on Windows 2000 using a floppy drive (FAT) and determined that is does not
> >copy the slack space, but I'm having difficulty creating a test that uses a
> >hard drive formatted with NTFS and FAT32 (can't determine what sectors my
> >test file is occupying, so I can't write stuff into the slack space).
> >
> >If anyone can give me a definitave answer or some method I can use to test
> >it myself I would be grateful.
>
>

Relevant Pages

  • Re: Finding REALLY hidden files?
    ... Virtually all hard disk drives use, at the physical level, a sector ... the slack space is 511 bytes. ... large cluster size. ...
    (rec.video.desktop)
  • Re: Finding REALLY hidden files?
    ... Any left-over space in the last cluster of a file is lost, in that it will never be used for any other data. ... but slack space is slightly different than the space ... Virtually all hard disk drives use, at the physical level, a sector ... if the cluster size is 32 KB (and under FAT32 I *have* had drives with clusters that big) and you create a file of length one byte, it is not just the 511 bytes in the first sector that are lost to further use, it is also the 512 bytes in each of the other ...
    (rec.video.desktop)
  • Re: How to "wipe" ALL Mac files slack space?
    ... (sector is half of one KB, ... The part of the last 4KB cluster space that is NOT used by a file. ... i once wrote a program that wrote a block of zeros in the slack space by ... set the current write position to the current eof. ...
    (comp.sys.mac.system)
  • Re: Looking for Free Slack Space Wiping Util
    ... > allocated cluster is used and the unused part of the last cluster ... > it also opens a potential security problem when overwriting unused ... it doesn't appear to erase slack space ... >> AFAICT - does handle free space; ...
    (alt.computer.security)
  • Re: Finding REALLY hidden files?
    ... The disk storage for a file is allocated in fixed size units called ... This means that if the cluster is 32KB and the file length is 12 times ... but slack space is slightly different than the space ... Virtually all hard disk drives use, at the physical level, a sector ...
    (rec.video.desktop)