File Sector Limits

On most operating systems, a sector is the minimum division of a drive that can hold data - and equals 512 KB. On NTFS drives with 512 KB sectors, there are 8 sectors per cluster. Each file must take up at least one cluster, and every cluster must be at least 4096 KB. So if you have a file which equals 3012 KB, you will have 1084 KB of file slack - which can be made up of data from previous files - that can you recover in the discovery process.

In order to determine the cluster size on your drive follow these steps.

1. In Windows if you just go to Start and type 'cmd' and then enter the chkdsk command, you'll get an error message stating, "Access denied as you do not have sufficient privileges. You have to invoke this utility running in elevated model."

2. Get around this by going to Start . . . All Programs . . . Accessories . . . Command Prompt, and then right click and choose 'Run as Administrator'. See the screen grab below. You need to do this even if your user profile has full administrative rights.

3. Now type in the command, 'chkdsk'. After a while this command will show the type of your file system, the total disk space, the KB in bad sectors, and the bytes in each allocation unit. The allocation unit is equivalent to to the cluster size - so whenever a file doesn't add up equally to the size of a cluster or multiple clusters, there will be some file slack.