Re: How to "wipe" ALL Mac file's slack space?

In article <noneof-D1ED92.12524629062007@xxxxxxxxxxxxxxxxxxxxxxx>,
Mark Conrad <noneof@xxxxxxxxxxxxxxxxxx> wrote:

I now want to wipe the slack space in disk file "clusters".

Only reason for this post is if you are confused about the meaning of
the four terms sector, block, cluster, and slack space.

Do not read this post otherwise.




Do Not Read - - - Do Not Read - - - Do Not Read
***********************************************
***********************************************

Differences between sectors, blocks, clusters, and slack space -

Sectors
*******
Sectors are the smallest storage units on a disk drive. A sector is a
fixed size, commonly 512 bytes on a Mac disk drive.
(sector is half of one KB, or two sectors per KB)

Blocks
******
Blocks are groups of sectors, anywhere from one byte to a great many
bytes. I commonly set a block size to be 524288 bytes, for example.

One block can be set to a size of 512 bytes, in which case a block would
be exactly the same size as a sector.

Block sizes vary wildly, some people use the word "block" to mean the
same as the word "sector", which is very unwise.

Sectors are generally fixed in size at 512 bytes in the case of Macs,
while a block size can be "set" to be any number of bytes.

Block sizes can be "set" by utility programs such as dd, which is just
one of hundreds of free utility programs available to Mac users, from
inside the overall "Terminal" program (or "shell", if you prefer that
word instead of "Terminal"), all of which are part of OS X.


Cluster
*******
A cluster is kind of like a block, with important exceptions. A cluster
is a related number of sectors, related by the fact that those sectors
all have to relate to ONE file, never more than ONE file.

A cluster is a fixed size, determined by the file system; with the NTFS
system used by Intel Macs, the default cluster size is 4KB.

So what happens if a file is larger than 4KB, well then more clusters
are used, as many as necessary, but all clusters still relate to that
ONE file.

Clusters can hold major parts of a big file. The very last 4KB cluster
will hold the very last part of the big file.

So what happens if a really tiny file comes along, well then it STILL
has to use a full cluster of 4KB. Any erased file that was previously
in the slack space of that cluster is still there, available for any
snoopers to look at.



For example, assume you create a TextEdit file containing one word,
"Boo".

Save that file with the name "Small TextEdit".

Look at the file's size on disk with Get Info, when you will see that it
occupies 4KB of disk space, even though there are only 3 characters in
that file.

Now by contrast, create a large TextEdit file like the one right here
that you are reading right now. Name the file "Large TextEdit" then
save the file.


Look at the large file's size on disk with Get Info, when you will see
that it STILL occupies only 4KB of disk space, even though there are
over 3,000 characters in that file.


Slack space
***********
The part of the last 4KB cluster space that is NOT used by a file.

With a very large file, only the very last 4KB cluster of that large
file has any "slack space".



So, in conclusion, what is "slack space" in that "Small TextEdit" file
is ALL the space in the cluster that is unused, except the 3 bytes that
are used for that one word "Boo". In the case of that tiny file, over
4,090 bytes of slack space are available for snoopers to look at.

All your credit card info', bank account info', confidential info' about
your other 3 wives, etc. will fit in the slack space of that one small
file, even though you _thought_ you were safe because you knew you had
erased all that sensitive info' with TechTool Pro.

Mark-
.

Relevant Pages

  • Re: Hard Disk Failure
    ... is so much stuff on the hard disk that I want to try to keep. ... tool on the drives and this is the result. ... Sectors per Cluster: 8 ... MFT Start Cluster: 786432 ...
    (microsoft.public.windowsxp.hardware)
  • Hard Disk Failure
    ... is so much stuff on the hard disk that I want to try to keep. ... Sectors per Cluster: 8 ... MFT Start Cluster: 786432 ...
    (microsoft.public.windowsxp.hardware)
  • Re: Hard Disk Failure
    ... is so much stuff on the hard disk that I want to try to keep. ... tool on the drives and this is the result. ... Sectors per Cluster: 8 ... MFT Start Cluster: 786432 ...
    (microsoft.public.windowsxp.hardware)
  • Help on disk format when upgrade dosFS patch.
    ... format the SCSI disk, I found the disk format is a little bit different ... total number of sectors: 4,233,600 ... first cluster is in sector # 525 ...
    (comp.os.vxworks)
  • Re: Finding REALLY hidden files?
    ... The disk storage for a file is allocated in fixed size units called ... This means that if the cluster is 32KB and the file length is 12 times ... but slack space is slightly different than the space ... Virtually all hard disk drives use, at the physical level, a sector ...
    (rec.video.desktop)