Security Portal: Computer Crime Investigator's Toolkit: Part IV - Slack Files and CryptographyJan 24, 2001, 08:13 (1 Talkback[s])
(Other stories by Ronald Mendell)
"Slack space occurs on a hard drive or floppy when a file gets partially overwritten after deletion. The new file does not completely fill in the space created by the old file's data. So, a slack space of residual data remains in the area between the end of file (EOF) boundary of the new file and the end of the cluster. On a given disk, then, large amounts of "hidden data" exist. These fragments may offer considerable evidence about what was deleted from the disk...."
"Cryptography is a vast subject, and it can be as abstract as quantum physics. The average computer sleuth, though, does not have to know the inner workings of designing cryptographic algorithms. But, he or she does need to know the difference between simple and complex cryptography...."