Unallocated vs Free...
 
Notifications
Clear all

Unallocated vs Free Space

13 Posts
7 Users
0 Likes
1,927 Views
(@bjh505)
Posts: 10
Active Member
Topic starter
 

Hello

So I am noticing that in various locations across the internet people are using unallocated space and free-space synonymously. What is the general consensus here?

I have always associated unallocated space with space on a hard drive that is not part of a file system and free space as space that is available to be written or over-written if a file previously resided there(as far as an OS is concerned). So I will pose it another way.. if I delete a file from my desktop and remove it from my trash bin is it then unallocated space, free space, or both?

I have a follow-up question but I would like to see some peoples thoughts on this, thanks!

 
Posted : 10/02/2020 7:56 pm
(@tootypeg)
Posts: 173
Estimable Member
 

that data would now be unallocated

 
Posted : 10/02/2020 8:23 pm
(@rich2005)
Posts: 535
Honorable Member
 

I could be wrong, but I'm guessing this may come from EnCase using the term Unallocated Clusters, and ended up common parlance (that's what it called all the aggregated unused/no-longer-used space within a volume).
I could see why that makes sense, in that it's not completely free space, as it's part of a volume, but just not allocated to a file within the index of the volume. Free space being that which is completely free and not within a file-system (referred to as unused disk area I think in EnCase, off the top of my head, been a while now since I've used it).
On the other hand, you could reverse that logic, something that's not assigned to a file-system is unallocated, and the non-used area within a volume is free space 😉

I'm not sure there's a right answer on this one (who decides!).

 
Posted : 10/02/2020 10:02 pm
watcher
(@watcher)
Posts: 125
Estimable Member
 

Usually the context will tell you how the the word "unallocated" is being used, but it is often used both ways.

For example a discussion involving unallocated verse slack would be using unallocated to mean file system space not currently assigned, such as a deleted file.

Running gparted to examine partition layouts would show unallocated as indicating drive space that is not part of any partition.

 
Posted : 11/02/2020 4:24 am
(@athulin)
Posts: 1156
Noble Member
 

I have always associated unallocated space with space on a hard drive that is not part of a file system and free space as space that is available to be written or over-written if a file previously resided there(as far as an OS is concerned).

The 'unallocated' always raises the question 'by who or what?' There are multiple mechanisms, so ambiguities are easy to stumble into. Here are some possibilities

1. unallocated by partition management, and thus available for creating a new partition

2. allocated to a partition, but unused by volume management – this may also be referred to as some form of slack space allocated on one level (to a partition), but unused by the next lower level (not included in the volume created in that partition).

3. under volume management control (and thus allocated for the use of a volume), but at present not assigned to a file system entity.

4. Assigned to a file extent (i.e. it's some part of a cluster – or smallest allocatable unit on a volume, which in some file systems may be parts of a sector, as for ISO 9660), but currently not utilized (this is also a kind of slack space).

… and we may continue down the hierarchy if we want to. In an emulated disk, used by a virtual machine, the sequence can be repeated and in these cases, context/focus becomes very important to establish

(Slack space has been the subject of at least one major thread here.)

In most cases, the context is clear, and disambiguation is usually not necessary.

So I will pose it another way.. if I delete a file from my desktop and remove it from my trash bin is it then unallocated space, free space, or both?

Yes.

Unallocated to a file, but allocated to a volume as well as a partition

Free for use by a new file, but not free for use by another volume or partition. (Unless you have some really fancy dynamic volume/partition system.)

 
Posted : 11/02/2020 6:24 am
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Let's try to draw a line.

Free space is what you can actually see in many OS tools, it means "available space that can be written to".

When you start from a wiped device and create for the first time a filesystem, all the free space is made of 00's.

Unallocated is *whatever* is not allocated, usually (but not always) if within the filesystem it is the same as "free space", but there may be exceptions.

Belong to "unallocated" also the various forms of "slack" both within and outside the filesystem or volume, JFYI a tentative of slack definition is here
https://www.forensicfocus.com/Forums/viewtopic/t=9374/

In a nutshell
1) Free space = Space that is not allocated and accessible by the OS filesystem tools
2) Unallocated *anything* that is not allocated
3) Free space < Unallocated

jaclaz

 
Posted : 11/02/2020 12:18 pm
(@thefuf)
Posts: 262
Reputable Member
 

Let's try to draw a line.

Free space is what you can actually see in many OS tools, it means "available space that can be written to".

When you start from a wiped device and create for the first time a filesystem, all the free space is made of 00's.

Unallocated is *whatever* is not allocated, usually (but not always) if within the filesystem it is the same as "free space", but there may be exceptions.

Belong to "unallocated" also the various forms of "slack" both within and outside the filesystem or volume, JFYI a tentative of slack definition is here
https://www.forensicfocus.com/Forums/viewtopic/t=9374/

In a nutshell
1) Free space = Space that is not allocated and accessible by the OS filesystem tools
2) Unallocated *anything* that is not allocated
3) Free space &lt; Unallocated

jaclaz

Okay. How would you call sectors with data from a previous file system existed on the same device, but marked as allocated by a current file system (not available for allocation anymore) and being part of active data of a system file (if you read this file, some sectors will contain data from a previous format)?

 
Posted : 11/02/2020 12:24 pm
(@rich2005)
Posts: 535
Honorable Member
 

As I say……I think this is a "the sky is blue" versus "the sky is black" argument.

 
Posted : 11/02/2020 12:31 pm
jaclaz
(@jaclaz)
Posts: 5133
Illustrious Member
 

Okay. How would you call sectors with data from a previous file system existed on the same device, but marked as allocated by a current file system (not available for allocation anymore) and being part of active data of a system file (if you read this file, some sectors will contain data from a previous format)?

If I get it right, they are allocated (now).

The fact that they contain not what the filesystem believes they should is another matter, if you prefer they are a form of steganography, they do not "belong" to either unallocated (as they are actually allocated) nor to free space (as they are actually allocated).

More practical example
In the current filesystem sectors LBA 2125857 up to LBA 212585865 (8 sectors by 512 bytes each) belong to the cluster (say) #9857 (4 KB clusters) and are allocated in the current (NTFS) filesystem as \myfake.txt with exactly 4096 bytes size.

When you open \myfake.txt with notepad you discover that it actually contains non ASCII characters and when you re-open the same \myfake.txt file with a hex viewer/editor you find out that the contents is (say) the bootsector and 7 following sectors coming from a previous logical volume formatted by DOS in FAT32.

What gives? ?

Or I am misunderstanding you? ?

jaclaz

 
Posted : 11/02/2020 12:39 pm
(@thefuf)
Posts: 262
Reputable Member
 

That doesn't make sense. This data, by its nature, doesn't belong to a current file system (it was created before the format), but it's listed as allocated (and as active file data) by that file system.

A test image is here https://github.com/msuhanov/ntfs-samples/blob/master/ntfs-ptrn.raw.gz

Check the following data streams of the "/$Extend/$RmMetadata/$Repair" file "$Corrupt" and "$Verify".

This image was filled with the "PTRN" byte pattern prior to the formatting.

 
Posted : 11/02/2020 12:48 pm
Page 1 / 2
Share: