u/opxz

As the title says, somewhat of a reverse forensic journey to backtrace the work that's been done on a set of data. I've got a drive that has a filesystem recovered from another drive. Since there are "-slack" files present I suspect the recovery has been done with some forensic/recovery program.

There are many that have "slack support" but my focus is figuring out which one (hopefully singular) has a default setting of outputting "filename.ext-slack".

For example I think that FTK Imager outputs "filename.ext.FileSlack", so that might be ruled out. The problem is that "-slack" doesn't work well with search engines and the manuals for the different programs don't really go into details on what schema they use for output.