Today in class we learned about how information can be uncovered in a file slack. I understand this theoretically, given the physical and logical file size I can come up with the slack space of a file. However, how can I uncover this information in the slack space if I wanted to know if there is anything valuable in a certain file slack? I've been using a hex editor to look at the disk and the files but I am not sure where to go from here. I heard that enCase is a good resource, however I am not able to find the link to download on Ubuntu or Mac for free