is slack area = unallocated spaces? deleted files can create slack place, besides deleted files, any other source for slack area? thanks
Slack area is cluster minus sector size . Unallocated means free space
Slack occurs when there is a difference between the amount of data you need to write (logical size) and the smallest unit which the hardware or software can write (e.g. sector size in an HDD or cluster/block size from the file system). So slack space is created virtually every time a file is written. If a new file is being written over deleted data, and the new file doesn't fill the sector or cluster, it is possible that parts of the deleted file could be present in the slack space after the new file. However, this is not guaranteed as it can depend on the specific hardware, file system and operating system in use.
Generally, unallocated space refers to areas of the storage that are not currently within a valid partition (and so can't be accessed via the file system). As partitions, file systems, and data can all change over time, currently being unallocated doesn't mean the space has never been used so it could contain all sorts of artefacts.
Previous thread with proposed definitions and related discussion
https://www.forensicfocus.com/Forums/viewtopic/t=9374/
jaclaz