EC-Council
312-49 · Question #312
In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?
Sign in or unlock 312-49 to reveal the answer and full explanation for question #312. The question stem and answer options stay visible for context.
Submitted by femi9· Apr 18, 2026Disk Forensics
Question
In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?
Options
- Aone who has NTFS 4 or 5 partitions
- Bone who uses dynamic swap file capability
- Cone who uses hard disk writes on IRQ 13 and 21
- Done who has lots of allocation units per block or cluster
Unlock 312-49 to see the answer
You've previewed enough free 312-49 questions. Unlock 312-49 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.
Topics
#File Slack#Disk Allocation Units#Cluster Size