RAM Slack (dt. main storage sector disalignment) describes directly from the RAM of a system coming and by the operating system the arbitrarily transferring data fragments, on unallozierte ranges of a data medium (data on sector remainders).

Ms systems (FAT/NTFS) write in 512 byte large blocks, also sectors mentioned, which form the smallest imagable memory unit on a data medium generally to data. A file the assigned sectors (called in its majority cluster) do not agree accurate however always with the actual size of the file which can be stored, so that it comes in this connection to a sector blend. Any longer if sufficient data are not to be filled available around the last assigned sector of a file completely, Windows the remainder of the last remaining sector adds indiscriminately data from the MEMORY Buffer. These coincidentally selected filling up data are called "RAM Slack ", since the data can originate directly from the RAM of the system and excluding only in the last sector a file be found. This RAM Slack can contain therefore in extreme cases very sensitive and personal information fragments, which can have developed since the last boat of the system and partly unencrypted in the RAM were present, as e.g. worked on documents, the attendance of a secured web page or unprotected entrance words.

Still frequently the file system ext2 used under Linux stores data in blocks and forms also Slack ranges, if the stored files use less than 1, 2, or 4 KB of the file system blocks. Here data fragments within the Slack ranges can be found just like under Windows.

RAM Slack, when a component of the superordinate term of the file Slack, is not to confound with the Swap and/or paging ranges, which offer many operating systems for the extension of the physically usable storage area. RAM Slack neither visibly belongs to the unalloziierten data fragments, the appropriate operating system without effort of the user and for it with conventional and commercial Tools, nor profitable, in the background on the data medium, when "stores filling up data".

RAM Slack receives therefore above all a large attention in the computerforensischen investigations and determinations of punish-pursuing authorities, on the basis of computer criminality.

Articles in category "RAM Slack"

We found here 6 articles.