312-49 · Question #634
If the partition size is 4 GB, each cluster will be 32 K. Even if a file needs only 10 K, the entire 32 K will be allocated, resulting in 22 K of ________.
The correct answer is A. Slack space. File systems allocate disk space in fixed-size units called clusters. When a file does not consume the entire last allocated cluster, the leftover space within that cluster is called slack space (specifically 'file slack' or 'cluster slack'). In this example, a 10 KB file is allo
Question
If the partition size is 4 GB, each cluster will be 32 K. Even if a file needs only 10 K, the entire 32 K will be allocated, resulting in 22 K of ________.
Options
- ASlack space
- BDeleted space
- CSector space
- DCluster space
How the community answered
(29 responses)- A93% (27)
- B3% (1)
- D3% (1)
Explanation
File systems allocate disk space in fixed-size units called clusters. When a file does not consume the entire last allocated cluster, the leftover space within that cluster is called slack space (specifically 'file slack' or 'cluster slack'). In this example, a 10 KB file is allocated a full 32 KB cluster, leaving 22 KB of unused slack space. This slack space is forensically significant because it may retain fragments of data from files that previously occupied that disk location, potentially providing investigators with recoverable evidence even after files have been overwritten or deleted.
Topics
Community Discussion
No community discussion yet for this question.