Jump to content

Wipe file tails (slack space)


Recommended Posts

It would be nice if there were an option to wipe the file tails (also called "slack space") on a volume. For those who are unaware, the "slack space" is the unused space beyond the end of a file in the last allocated cluster for that file. Information stored in slack space can last a very long time and cannot be destroyed with the method used by "wipe free space."

 

For example, a typical NTFS cluster size is 4096 bytes. If a file is 15000 bytes in size, it occupies 4 x 4096-byte clusters, a total of 16384 bytes of allocated space. The 1384 extra bytes allocated may already contain information from a file that was deleted. Multiply that by tens of thousands of files and you can see why these file tails are a forensic treasure trove of data, especially since file tails survive even the most "secure" wipes of free space.

Link to comment
Share on other sites

  • Moderators
Windows NT implements Object Reuse Protection, which means that when a new file is created both the memory and disk space allocated to it are zero-filled. So a new file should not contain any information from a previous use in its slack space. If a file is edited to reduce the length of the data then it might be possible to see part of the old data in slack space. Whether this happens or not could be tested with a hex editor, perhaps by someone more intrigued than me.

 

I don’t know of a way to wipe slack space with the file in place on the disk and I haven’t looked to see if anyone claims to do it. It could be done by some method of copying the files to another device, wiping the disk, and then copying back, but I don’t think that CC will ever do that. You could start with a clean slate and then run CC’s secure delete on everything with Wipe Cluster Tips checked, or if you’re really worried use encryption.

Link to comment
Share on other sites

  • 1 month later...

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now
×
×
  • Create New...

Important Information

By using this site, you agree to our Terms of Use.