Also sometimes referred to as “ambient
data,” this is data or information that is not actively used on a computer
system. Residual data includes data found in unallocated blocks on storage
media; data found in the slack space of files and file systems; and data within
files that has technically been deleted so that it is not accessible by the
application used to create the file. To access any of these three types, one
must undelete or use special data-recovery tools. Forensic investigators sift
through the residual data to find traces of wrongdoing on computer systems
under investigation.
See Also:
Remanence.