Re: How to "wipe" ALL Mac file's slack space?

In article <noneof-766A98.12574229062007@xxxxxxxxxxxxxxxxxxxxxxx>,
Mark Conrad <noneof@xxxxxxxxxxxxxxxxxx> wrote:

In article <noneof-D1ED92.12524629062007@xxxxxxxxxxxxxxxxxxxxxxx>,
Mark Conrad <noneof@xxxxxxxxxxxxxxxxxx> wrote:

I now want to wipe the slack space in disk file "clusters".

Only reason for this post is if you are confused about the meaning of
the four terms sector, block, cluster, and slack space.
[snip]

Blocks
******

When this term is used with the Mac filesystem, it refers to what Mark
will call a cluster, a term probably more familiar to PeeCee users than
Mac users.

As far as I know, blocksize is never used as a unit of allocation in the
filesystem. It is used by several filesystem display utilities and as
an aggregation specification in the obscure dd command.

[snip]

Cluster
*******
A cluster is kind of like a block, with important exceptions. A cluster
is a related number of sectors, related by the fact that those sectors
all have to relate to ONE file, never more than ONE file.

A cluster is a fixed size, determined by the file system; with the NTFS
system used by Intel Macs, the default cluster size is 4KB.

Intel Macs use the HFS+ filesystem, not NTFS.

So what happens if a file is larger than 4KB, well then more clusters
are used, as many as necessary, but all clusters still relate to that
ONE file.

Clusters can hold major parts of a big file. The very last 4KB cluster
will hold the very last part of the big file.

[snip]

Slack space
***********
The part of the last 4KB cluster space that is NOT used by a file.

I.e. the difference between Get Info's size on disk and the
parenthesized content size.

With a very large file, only the very last 4KB cluster of that large
file has any "slack space".

So, in conclusion, what is "slack space" in that "Small TextEdit" file
is ALL the space in the cluster that is unused, except the 3 bytes that
are used for that one word "Boo". In the case of that tiny file, over
4,090 bytes of slack space are available for snoopers to look at.

Which is why I secure delete my sensitive files.

All your credit card info', bank account info', confidential info' about
your other 3 wives, etc. will fit in the slack space of that one small
file, even though you _thought_ you were safe because you knew you had
erased all that sensitive info' with TechTool Pro.
.

Relevant Pages

  • Re: Looking for Free Slack Space Wiping Util
    ... > allocated cluster is used and the unused part of the last cluster ... > it also opens a potential security problem when overwriting unused ... it doesn't appear to erase slack space ... >> AFAICT - does handle free space; ...
    (alt.computer.security)
  • Re: Finding REALLY hidden files?
    ... The disk storage for a file is allocated in fixed size units called ... This means that if the cluster is 32KB and the file length is 12 times ... but slack space is slightly different than the space ... Virtually all hard disk drives use, at the physical level, a sector ...
    (rec.video.desktop)
  • Re: How to "wipe" ALL Mac files slack space?
    ... When this term is used with the Mac filesystem, ... the default cluster size is 4KB. ... 4,090 bytes of slack space are available for snoopers to look at. ...
    (comp.sys.mac.system)
  • Re: How to "wipe" ALL Mac files slack space?
    ... in the slack space by the following method. ... "A cluster is a fixed size, determined by the file system; ... system used by Intel Macs, the default cluster size is 4KB." ... A file 'cluster' just basically means a bunch of file fragments, ...
    (comp.sys.mac.system)
  • Re: Finding REALLY hidden files?
    ... Any left-over space in the last cluster of a file is lost, in that it will never be used for any other data. ... but slack space is slightly different than the space ... Virtually all hard disk drives use, at the physical level, a sector ... if the cluster size is 32 KB (and under FAT32 I *have* had drives with clusters that big) and you create a file of length one byte, it is not just the 511 bytes in the first sector that are lost to further use, it is also the 512 bytes in each of the other ...
    (rec.video.desktop)