software that can view files in Volume Slack


athulin

Member
Experienced Member
Oct 18, 2007
734
Ratings
11
18
#2
oncetwice said:
Can someone recommend a software that can extract/view files directly from the Volume Slack of a dd file?
You may want to clarify your use of the term 'volume slack'.

To me, it means the space between the end of the volume and the end of the allocation unit that volume is contain in, i.e. the partition. (Just as file slack is the space between the end of the file, and the end of the allocation unit -- typically a cluster -- inside which the file data exists.)

However, files don't exist in volume slack -- they only exist inside volumes. So ... you may be using a different definition of the term. (Or you may be referring to remains from earlier partition contents or even earlier disk contents.)

In any case, any decent file carving software should help you, but which to choose often depends on what kind of files you want to retrieve. You may also need to isolate the volume slack first, to avoid carving other irrelevant data from other parts the image.
 

oncetwice

New Member
Jun 23, 2017
9
0
#3
athulin said:
oncetwice said:
Can someone recommend a software that can extract/view files directly from the Volume Slack of a dd file?
You may want to clarify your use of the term 'volume slack'.

To me, it means the space between the end of the volume and the end of the allocation unit that volume is contain in, i.e. the partition. (Just as file slack is the space between the end of the file, and the end of the allocation unit -- typically a cluster -- inside which the file data exists.)

However, files don't exist in volume slack -- they only exist inside volumes. So ... you may be using a different definition of the term. (Or you may be referring to remains from earlier partition contents or even earlier disk contents.)

In any case, any decent file carving software should help you, but which to choose often depends on what kind of files you want to retrieve. You may also need to isolate the volume slack first, to avoid carving other irrelevant data from other parts the image.
I'm talking about the files found in slack spaces. Is Volume Slack considered slack space?
 

About us

  • Our community began in 2004. Since this time, we have grown to have over 29,000+ members within the DFIR & Cyber Security community.

    We are happy to announce that this forum is now under new ownership with the goal to once again become the main Digital Forensics Forum on the internet for DFIR, OSINT and Cyber Security.

    If you can think of ways to help us improve, please let us know.

    We pride ourselves on offering unbiased, critical discussion among people of all different backgrounds.

    We are working every day to make sure our community is one of the best.

Quick Navigation

User Menu