Inside the Drive: Sectors, Clusters, File Systems and Slack Space

What you'll be able to do

By the end of this lesson you will be able to explain how a storage device holds data, and why that structure leaves evidence behind.

• Describe the physical parts of a hard drive: platters, heads, tracks and sectors.
• Explain the logical view the operating system uses: partitions, clusters and file systems.
• Calculate slack space for a file, and explain why solid-state drives behave differently.

The Physical Drive

The book explains that hardware has two aspects, physical and logical. Physically, a traditional hard disk drive has two basic parts for storing data:

• Platters. Rigid disks, stacked on a spindle, where data is written. Each surface is coated with a magnetic film, and tiny regions of it are magnetized one way or the other to represent ones and zeros.
• Heads. One head for each side of each platter, on an arm that moves across the surface to read and write data while the platters spin.

Each platter surface is divided into tracks, concentric circles running around the platter, and each track is divided into sectors, the smallest unit the drive reads or writes. The more platters and heads a drive can fit, the more it can hold.

The Logical Drive

The operating system does not think in platters and heads. It works with the drive logically, to know where to put data and where to find it again:

• Partitions. A drive is divided into one or more partitions, each of which can hold its own file system.
• Clusters. The file system allocates space in clusters (also called allocation units). One cluster is made of several sectors.
• File systems. The file system is the scheme that records which clusters belong to which file, along with names, dates and other details. On Windows, the book names FAT (File Allocation Table) and NTFS (New Technology File System).

The partition types and the sizes of partitions and clusters are decided when the drive is partitioned and formatted. On NTFS, every file has an entry in the Master File Table (MFT), which holds its size, timestamps, permissions and the location of its data. A very small file's contents can even be stored inside its MFT entry itself rather than in a separate cluster, which is one more place where tools must look.

Slack Space: Where Leftovers Live

Clusters and sectors have fixed sizes. When a file is saved, it is given whole sectors and whole clusters, even if it does not fill them. The leftover space is called slack space.

The book's example uses the traditional sizes of 512-byte sectors and 2 KB clusters (four sectors per cluster). Take a file of 712 bytes:

1. It fills the first 512-byte sector completely.
2. The remaining 200 bytes go into the second sector, leaving 312 bytes unused at the end of that sector.
3. The third and fourth sectors of the cluster are allocated to the file but not used at all.

All of that unused-but-allocated space is slack. Why does it matter? Because the system does not necessarily wipe the space it allocates. The slack may still contain fragments of whatever was stored there before, for example the start of a deleted file. (On modern systems the unused end of the last sector is usually filled with zeros, so remnants are most often found in the whole unused sectors after it.) Analyzing slack space can recover evidence that the user believes is long gone.

Other Devices

The book notes that every device that stores data has a similar structure. USB sticks, memory cards and other media may allocate data differently, but the principles of allocation units, slack and recoverable remnants are the same. Lesson 2.4 covers the other place data lives: the computer's memory.

Real-World Example

Imagine (a fictional scenario) a case in which a suspect claims he never had a particular contract on his laptop. The active files show nothing. But in the slack space of an unrelated, recently saved document, the examiner finds a fragment of text, part of a paragraph, matching a clause in the contract. The space had once belonged to a larger file that was deleted. The fragment cannot show when the contract was on the drive or who put it there, and the examiner says so. It does show that text from the contract was stored on this drive at some point, which contradicts the suspect's claim and gives investigators a reason to look further.

From the Book to 2026

What the book teaches. Drives store data in sectors grouped into clusters, traditionally 512-byte sectors and 2 KB clusters. Slack space between the end of a file and the end of its cluster can hold evidence, and deleted data can often be recovered.

Why it made sense. For magnetic hard drives this is exactly right, and slack space remains a standard part of forensic examination.

What has changed. Three refinements. First, sizes: many modern hard drives use 4,096-byte physical sectors (Advanced Format), and Microsoft documents 4 KB as the default NTFS cluster size. The arithmetic is the same, only the numbers change. Second, file systems have moved on: Macs now use APFS, Linux commonly uses ext4, and USB sticks and memory cards often use exFAT. Third, and most important, solid-state drives (SSDs) have no platters or heads. They store data in flash memory managed by their own controller. When the operating system deletes a file, it can send the SSD a TRIM command, and the drive's internal garbage collection may then erase those blocks by itself whenever the drive has power, even after it has been seized and even when it is connected through a write-blocker. One 2023 study found that how much deleted data survives on an SSD varies with the manufacturer, the operating system, the file type and the time since deletion.

What to do now. Never assume that deleted data on an SSD is recoverable, and never assume it is gone. Acquire SSDs promptly, record the drive type in your notes, and state in your report that results on flash storage depend on the device.

Watch: How Do Hard Drives Work?

This animated TED-Ed lesson, created by educator Kanawat Senanan, explains how a hard drive can hold so much information in such a small space. It traces the work of the engineers, materials scientists and physicists who developed it.

Questions to keep in mind as you watch:

• How are the ones and zeros physically recorded on a platter?
• What do the heads do, and why does the drive spin so fast?
• Why would none of this apply to a solid-state drive, and what does that mean for deleted data?

The video complements what you just read. The lesson is complete without it. For an optional deeper look at SSDs, see the further-study link on this lesson.

What Would You Do?

You seize two laptops in the same case. One has a magnetic hard drive and one has an SSD. Both suspects deleted files a week ago. The case officer asks which laptop is more likely to yield deleted files, and whether imaging can wait until next month. What do you tell them? Decide, then compare with the model answer in the note below.

Knowledge Check

Key Takeaways

• Physically, a hard drive stores data on platters, read by heads, in tracks divided into sectors.
• Logically, the operating system uses partitions, clusters and a file system such as FAT or NTFS.
• Slack space, the unused part of a file's last sector and cluster, can hold fragments of earlier data.
• Today's sizes are often 4,096-byte sectors and 4 KB clusters, and SSDs may erase deleted data by themselves through TRIM and garbage collection.

Sources

• Dr. Tahseen Al-Doori — IT Forensics Essentials: Concepts, Tools, and the Practice of Digital Investigation, Chapter 2.4
• Microsoft Learn — NTFS overview (cluster sizes; 4 KB default)
• Microsoft Learn — Master File Table (Local File Systems)
• Microsoft Learn — Microsoft support policy for 4K sector hard drives in Windows
• Apple Support — File system formats available in Disk Utility on Mac
• The Linux Kernel documentation — ext4 Data Structures and Algorithms
• arXiv — SSD Forensic: Evidence Generation and Forensic Research on Solid State Drives Using Trim Analysis (2023)
• TED-Ed — How do hard drives work? (Kanawat Senanan)