Slack space, sometimes referred to as cluster tips, is the portion of a hard drive that extends from the end of a complete file and to the end of the file cluster where it is stored. For example, let's take a computer operating system (OS) that stores data in clusters that are 4kb in size. If a 2kb file is written to this cluster, it only encompasses the first two kilobytes of the cluster. This leaves two kilobytes of free space, or slack space, remaining that specific cluster.

As such, slack space within a few clusters isn't usually a big deal. Once your slack space grows to several megabytes or gigabytes in space, however, it can have a negative effect on overall performance - not to mention the amount of disk space it requires for storage.

Slack Space in Digital Forensics
The field of digital forensics often analyzes slack space in order to identify past files - or portions of past files - that have since been deleted and, in some cases, written over with new data. Taking the example given above of a 4kb cluster and a 2kb file contained within, what happens if we then delete the file in the cluster?

If the file is deleted through traditional means, it's not actually being removed from the hard drive. Instead, all of the internal pointers and references to that file are removed. The data remains in its original location - in this case, it's the first two kilobytes of the 4kb cluster - it's just not visible within your OS.

Now, let's say you've stored a new file that is 1kb in size to that same 4kb cluster. The new file takes up the first kilobyte of the cluster - effectively overwriting the first portion of the 2kb file we used in the original example. Because the second half of our original file hasn't been overwritten, it's possible, via the use of advanced digital forensics tools, to view the second half of the original 2kb file.

Again, this is because the original 2kb file was never truly removed from your hard drive - it just appears that way after deletion. Since the 1kb file only takes up half the space of the original file, it only overwrote the first half.

Wiping Cluster Tips
Some advanced file deletion and hard drive cleaning utilities provide users with the option to "wipe cluster tips" or "clear slack space." If a file has been deleted this way, any information that remains within the used clusters will be deleted, too.

This method is often done as a secure means of deleting files or erasing a hard drive. It's a great method to use when trying to dispose of confidential or sensitive data, but, since it's not built-in to any modern OS available today, it does require the use of third-party software.

Dealing with Slack Space
For the average computer user, slack space isn't much of a concern. For those who regularly work with confidential or sensitive documents, however, slack space could be used - either by an outside hacker or a hired digital forensics investigator - to uncover your data.

You may read more about the cluster tips (slack space) in Wikipedia: NTFS.