Retention of micro-fragments in cluster slack - A first model

In current forensic practice it is regularly needed to determine whether some set of files have been present on a storage medium or not. File carving techniques are readily used as a tool in such examinations. However, if all clusters holding the files searched for have been overwritten, remains of the previous files only resides in the cluster slack. In this work we elaborate on the factors that influence how many such cluster slack ¿micro-fragments¿ that can be expected to be detected. We identify a set of factors that influence the micro-fragment retention characteristics. One such characteristic is the file size distribution of the files overwriting the original files. We derive analytical expressions for three different file size distributions, which allows us to examine the retention characteristics even if the overwriting files come from different sources.