Or is it cut yourself some slack? When it comes to slack space, Craig says it just may not be worth it to search much anymore.
In his latest post on his Ball in Your Court blog (Don’t Bet the Farm on Slack Space), Craig asks the question how often it makes sense to search slack nowadays.
So, what is slack space and why should you care? As Craig defines it (or reminds us if we already knew it):
“Slack space is the area between the end of a stored file and the end of its concluding cluster: the difference between a file’s logical and physical size. It’s wasted space from the standpoint of the computer’s file system, but it has forensic significance by virtue of its potential to hold remnants of data previously stored there.” But, “[s]lack space is often confused with unallocated clusters or free space, terms describing areas of a drive not currently used for file storage (i.e., not allocated to a file) but which retain previously stored, deleted files.”
Data recovered (the process of which is known as “carving”) from unallocated clusters of free space can be quite large, potentially spanning thousands of clusters. But, “data recovered from a stored file’s slack space can never be larger than one cluster minus one byte.” Also, “unallocated clusters often retain a deleted file’s binary header signature serving to identify the file type and reveal the proper way to decode the data, whereas binary header signatures in slack space are typically overwritten.”
Craig also notes that slack space “can be a real mess” in that it can hold the remnants of multiple deleted files. Not only that much of the data stored on media today is compressed in Zip-compressed XML formats. And, “the parts of the Zip file required to decompress the snippet has likely been obliterated”. Not to mention, the storage hardware drives “are routinely encrypted, and some encryption methods make it difficult or impossible to explore the contents of file slack.”
So, before an expert characterizes it as essential or a requesting party offers it as primary justification for an independent forensic examination, Craig said he would “urge the parties and the Court to weigh cost versus benefit; that is, undertake a proportionality analysis in the argot of electronic discovery. Where searching slack space was once a go-to for forensic examination, it’s an also-ran now.” In other words, “don’t bet the farm on finding the smoking gun.”
As usual, Craig raises an interesting point while educating his audience on why you should care about the issue in the first place.
So, what do you think? Do you have many cases which call for forensic examination? If so, are you finding useful evidence in slack space? Please share any comments you might have or if you’d like to know more about a particular topic.
Disclaimer: The views represented herein are exclusively the views of the author, and do not necessarily represent the views held by my employer or my clients. eDiscovery Today is made available solely for educational purposes to provide general information about general eDiscovery principles and not to provide specific legal advice applicable to any particular circumstance. eDiscovery Today should not be used as a substitute for competent legal advice from a lawyer you have retained and who has agreed to represent you.