I'm looking over a case that just came in and I was examining the cookies because the client wanted them looked over. I noticed that 3 of the files have file slack. Is this because a bigger file was there and when the current cookie was written to that sector, it was smaller than the previous one? Also, all the cookies begin in various sector offset's except for one; which begins in sector offst 0. Any ideas? I've asked around in my shop and they have no clue, we've googled all day and found nothing.