Residue or Residual Data

Also sometimes referred to as “ambient data,” this is data or information that is not actively used on a computer system. Residual data includes data found in unallocated blocks on storage media; data found in the slack space of files and file systems; and data within files that has technically been deleted so that it is not accessible by the application used to create the file. To access any of these three types, one must undelete or use special data-recovery tools. Forensic investigators sift through the residual data to find traces of wrongdoing on computer systems under investigation.

See Also: Remanence.