Today in class we learned about how information can be uncovered in a file slack. I understand this theoretically, given the physical and logical file size I can come up with the slack space of a file. However, how can I uncover this information in the slack space if I wanted to know if there is anything valuable in a certain file slack? I've been using a hex editor to look at the disk and the files but I am not sure where to go from here. I heard that enCase is a good resource, however I am not able to find the link to download on Ubuntu or Mac for free
I think you want Filesystem Slack. As Xaqron says, you will need a hex editor that can open drives, because opening up a file will only help you with File Slack, not Filesystem Slack.
Preferably you should use a Hex editor that shows the ASCII characters at the same time as the hex data.
Manual review using Hex editor
Once you have such an editor, you have to find out what you are looking for?
Let's imagine that you are looking for a Word document that has been erased. The best way to start is to look at a Word document with a Hex Editor, and then find some kind of code at the very beginning of the file, which you will likely see on all word documents.
Once you find such code, you will be able to search for this in the slack space.
One problem you will find is that opening a drive directly will show you all data, both Allocated and Slack. Unfortunately, it is difficult for a human to distinguish which is which. For example, if there are some real Word documents, as well as deleted ones, then how could you tell the difference? This would be very difficult.
Perhaps you will instead need to search for key words or phrases that you are interested in. Keep in mind, that some documents will encode the text differently. Again, you should compare what non-deleted files look like before searching this in Slack space.
The same principals apply for any document type, not just Word. For example Image files often have a few bytes at the beginning that you can use to tell what type of file it was. Unfortunately, images are heavily encoded so you cannot search their contents.
Some files like
txt do not have such identification, but are also very light on the encoding, so they are easier to find in slack space.
Keep in mind that Slack Space will often be a mess, with partially overwritten or expired chunks of files. De-fragmentation processes or re-allocation to other files can introduce gaps in what you are able to recover.
A couple more things come to mind.
There may be a specialized hex editor or other tool available that will highlight and search Slack Space separately from Allocated Space. I don't know if there is one, but it seems like there would be. This would really help your manual review process.
There are applications designed to identify and restore files out of Slack Space. These automated tools (restore deleted files) are readily available and are the easiest way to get something productive done.
What you are looking to do is called forensic analysis, and the process is fairly simple: create a file containing a copy of the disk image, load the image into an analysis tool, and start hunting.
To create a disk image of a hard disk on a Windows machine, probably the easiest way is to boot to a LiveCD distro of Linux, and use dd to copy the disk image to a file somewhere. There are freeware and other tools that supposedly can make a disk image under Windows, and they work fine for USB sticks and removable drives. (Also note that an encrypted disk will effectively prevent making a useful image.)
For analysis, EnCase is a tool that many professional investigators use. (I believe there is a free version available to students.) But it's all closed source, and the fully licensed product is quite expensive.
There is a very good open source tool called The Sleuth Kit, and a Windows GUI version available called Autopsy. Autopsy makes it easy to open a disk image file, search through the disk, recover "deleted" files, and examine what's in the slack space. There is a module that helps find deleted images, which are often the focus of an investigation. You'll find it's well documented, and the web has a lot of good tutorials.