312-49 · Question #263
Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?
The correct answer is D. Slack Space. Slack space is the unused storage area that exists at the end of a file's last allocated cluster. Since files are stored in fixed-size clusters, a file rarely fills its last cluster exactly. The remaining space between the end of the file and the end of the cluster is called…
Question
Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?
Options
- ASector
- BMetadata
- CMFT
- DSlack Space
How the community answered
(28 responses)- B7% (2)
- C4% (1)
- D89% (25)
Explanation
Slack space is the unused storage area that exists at the end of a file's last allocated cluster. Since files are stored in fixed-size clusters, a file rarely fills its last cluster exactly. The remaining space between the end of the file and the end of the cluster is called file slack. This area may contain remnants of previously stored data from older files that once occupied those clusters. Forensic investigators frequently analyze slack space to recover evidence. A Sector is a physical storage subdivision of a track. Metadata is data about data (file name, timestamps, permissions). The MFT (Master File Table) is the NTFS index of all files - none of these describe leftover data in partially overwritten clusters.
Topics
Community Discussion
No community discussion yet for this question.