Glossary
File slack
The gap between a file's logical end and the end of its last allocated cluster. It often retains fragments of whatever occupied that cluster before.
Filesystems allocate space in whole clusters. A 100-byte file on a 4 KiB cluster still owns the full 4096 bytes, so 3996 bytes past the file's logical end belong to it on disk but are not part of its content. That tail is file slack.
It matters because the operating system does not wipe a cluster before handing it to a new, smaller file. The new file's data lands at the start; the previous occupant's bytes survive in the tail. Examiners pull recognizable fragments out of slack constantly: the back half of a deleted document, an old chat log, remnants of a wiped image.
Two regions are sometimes distinguished: RAM slack (the sector-aligning padding, historically memory contents) and drive slack (the rest of the cluster). The parser extracts a file's slack on NTFS, FAT, exFAT, ext and HFS+.