I got it now. File slack can break down into RAM slack and drive slack.
And since all data can rarely 100% reach the end of a sector after a file's been saved in sectors or clusters, OS writes RAM data right after that file, and put deleted files or data in the following space (sector(s)) (drive slack).
I'm trying to understand RAM slack and file slack raised on the topic of computer forensics.
So I kind of know that the RAM slack is like the leftover between the end of the logical file and the end of that one sector.
And if the file size is less than one sector size, what will be the File slack?
Suppose there are 512 bytes per sector.
The file (will call this original file later) is 400 bytes, and I got 112 bytes slack (is it a RAM slack or File slack?).
If I deleted the original file, it seems that the OS is not really deleting the file but is making the original sector(s) original file occupied available for reallocation, and the OS will add new file to this sector, which would probably (or must?) be smaller than the original file (ok, 200 bytes) and will be allocated to the original sector with the additional slack space of 112 bytes.
Therefore, 512bytes = 200bytes of new file + 200bytes of new slack + 112bytes of original RAM slack