272 䡲 Cyber Forensics Field Manual, Second Edition
It is important to understand the signifi cance of fi le slack in computer-related investigations.
Because fi le slack potentially contains data dumped randomly from the computer’s memory, it is
possible to identify network logon names, passwords and other sensitive information associated
with computer usage. File slack can also be analyzed to identify prior uses of the subject computer
and such legacy data can help the computer forensics investigator. File slack is not a trivial item.
On large hard disk drives, fi le slack can involve several hundred megabytes of data. Fragments of
prior e-mail messages and word processing documents can be found in fi le slack. From a computer
forensic standpoint, ...