We are committed to providing fast, efficient, and affordable software solutions that set new standards in the software development industry.
  • What are cluster tips (slack space)

Slack space, sometimes referred to as cluster tips, is the portion of a hard drive that extends from the end of a complete file and to the end of the file cluster where it is stored. For example, let's take a computer operating system (OS) that stores data in clusters that are 4kb in size. If a 2kb file is written to this cluster, it only encompasses the first two kilobytes of the cluster. This leaves two kilobytes of free space, or slack space, remaining that specific cluster.

As such, slack space within a few clusters isn't usually a big deal. Once your slack space grows to several megabytes or gigabytes in space, however, it can have a negative effect on overall performance - not to mention the amount of disk space it requires for storage.

Slack Space in Digital Forensics
The field of digital forensics often analyzes slack space in order to identify past files - or portions of past files - that have since been deleted and, in some cases, written over with new data. Taking the example given above of a 4kb cluster and a 2kb file contained within, what happens if we then delete the file in the cluster?

If the file is deleted through traditional means, it's not actually being removed from the hard drive. Instead, all of the internal pointers and references to that file are removed. The data remains in its original location - in this case, it's the first two kilobytes of the 4kb cluster - it's just not visible within your OS.

Now, let's say you've stored a new file that is 1kb in size to that same 4kb cluster. The new file takes up the first kilobyte of the cluster - effectively overwriting the first portion of the 2kb file we used in the original example. Because the second half of our original file hasn't been overwritten, it's possible, via the use of advanced digital forensics tools, to view the second half of the original 2kb file.

Again, this is because the original 2kb file was never truly removed from your hard drive - it just appears that way after deletion. Since the 1kb file only takes up half the space of the original file, it only overwrote the first half.

Wiping Cluster Tips
Some advanced file deletion and hard drive cleaning utilities provide users with the option to "wipe cluster tips" or "clear slack space." If a file has been deleted this way, any information that remains within the used clusters will be deleted, too.

This method is often done as a secure means of deleting files or erasing a hard drive. It's a great method to use when trying to dispose of confidential or sensitive data, but, since it's not built-in to any modern OS available today, it does require the use of third-party software.

Dealing with Slack Space
For the average computer user, slack space isn't much of a concern. For those who regularly work with confidential or sensitive documents, however, slack space could be used - either by an outside hacker or a hired digital forensics investigator - to uncover your data.

You may read more about the cluster tips (slack space) in Wikipedia: NTFS.

Data Recovery Feedback
370 feedbacks
Rating: 4.8 / 5
I really love your R-Studio product, I am doing Data Recovery as a professional, I used RS since the early versions and I loved the product, as far as I can tell, R-Studio, especially the Tech Version (but including the standard) is one of the best and excellent tools for a pro to have in the arsenal of tools in a pro DR lab, especially combining with the specialized Data Recovery hardware providers like DeepSpar, and PC3000, the rest of `wannabees` out there are waste of time, strongly recommend
I lost more than 200K files from my NAS due to a mistake. I tried 3 different recovery solutions over the 4 TB raid disks, and all of them performed ok but to be honest none of them were able to Raw recover the files and rename them with meaningful names out of the Metadata like R-TT did, then I was able to sort again my files and pictures and kind of restore all of them.

R-TT may not be the easiest or most user-friendly solution, but the algorithm used for the renaming saved me THOUSAND of hours of opening ...
Just recovered my old ext4 partition with R-Studio after trying testdisk and R-Linux without success. That partition was overwritten by another ext4 partition and I was losing my hope until I tried R-Studio demo. It detected all my files and directories again!

Bought it and 100% recommend it for anyone with a similar issue.
Genuinely tried every free program available without luck of recovering a deleted file from months ago. Thinking my file was deleted forever and lose all hope I came across this website as a recommendation.

I was reluctant as it seemed pricey compared to other programs, but damn worth every penny. It managed to even find files I thought were wiped from existence.

Kudos to r-tools, thank you!
Why make incremental backups, when there is R-Studio?

I`m an IT professional who has worked from home for over a decade. Early on in my career, I configured an HP ProLiant Server (Raid 1+0) as a workstation that I would remote into from my laptop. As technology evolved, I began to use it only for email and as a config file repository.

A short while ago, one of the drives degraded, but the HP ProLiant Server (Raid 1+0) still functioned fine on the remaining drive. I was complacent and didn`t replace the ...