Chapter 2 Key technical concepts Abstract Knowing how and where data is created and stored is essential in digital forensics. Chapter 2 takes a broad look at the key hardware … - Selection from The Basics of Digital Forensics, 2nd Edition [Book]
Slack space is an important form of evidence in the field of forensic investigation. Often, slack space can contain relevant information about a suspect that a prosecutor can use in a trial.A forensic image (forensic copy) is a bit-by-bit, sector-by-sector direct copy of a physical storage device, including all files, folders and unallocated, free and slack space. Forensic images include not only all the files visible to the operating system but also deleted files and pieces of files left in the slack and free space.