Five on Forensics Page 1 - Craig Ball

<strong>Five</strong> on Forensics
© 2002-2008 Craig Ball All Rights Reserved
a typical PC running Windows 98 (eight times less for Windows XP systems). This may not
seem like much, but the entire text of the U.S. Constitution plus the Bill of Rights can be
stored in less than 32,000 bytes!
Recall that file slack extends from the end of the file stored in the cluster until the end of the
cluster, but what about the morsel of slack that exists between the end of the stored file and
the end of the last sector. Remember that sectors are the smallest addressable unit of
storage on a PC and are strung together to form clusters. Sectors are only 512 bytes in size
and the computer, when it writes any data to disk, will not write less than a full sector. But
what if the file data being written to the last sector can’t fill 512 bytes and there is some slack
remaining? If the sector has space remaining in its 512 bytes which it can’t fill from the file
being stored, older file systems padded the remaining space with whatever happened to be in
the computer’s Random Access Memory (RAM) at that moment, hence the name “RAM
slack” (see Fig. 11). Granted, we are not talking about a whole lot of data—always less than
512 bytes—but it was enough for a password, encryption key, paragraph of text, or a name,
address and phone number. Everything you do on a computer filters through the computers
RAM, even if you don’t save it to disk; consequently, RAM slack can contain anything, and
there are at least as many instances of RAM slack on a computer that has been in use for
any length of time as there are files on the hard drive.
Figure 11
Swap Files
Just like you and me, Windows needs to write things down as it works to keep from
exceeding its memory capacity. Windows extends its memory capacity (RAM) by swapping
data to and from a particular file called a “swap file.” When a multitasking system such as
Windows has too much information to hold in memory at once, some of it is stored in the
swap file until needed. If you’ve ever wondered why Windows seems to always be
accessing the hard drive, sometimes thrashing away for an extended period, chances are it’s
reading or writing information to its swap file. Windows Vista, XP, NT and 2000 use the term
“page file” (because the blocks of memory swapped around are called pages), but it’s
essentially the same thing: a giant digital “scratch pad.”
Like RAM slack of yore, the swap file still contains data from the system memory;
consequently, it can contain information that the typical user never anticipates would reside
on the hard drive. Moreover, we are talking about a considerable volume of information.
How much varies from system-to-system, but it runs to millions and millions of bytes. For
example, the page file on the XP laptop used to write this article is currently about 1.6
gigabytes in size. As to the contents of a swap file, it’s pretty much a sizable swath of
Page 27