nerdexam
EC-Council

312-49 · Question #81

If the partition size Is 4 GB, each cluster will be 32 K. Even If a file needs only 10 K, the entire 32 K will be allocated, resulting In 22 K of___________.

The correct answer is A. Slack space. Slack space (also called file slack) is the unused storage space that exists between the end of a file's actual data and the end of the last cluster allocated to that file. File systems allocate storage in fixed-size units called clusters. If a file only uses part of a cluster…

Submitted by tunde_lagos· Apr 18, 2026Disk Forensics

Question

If the partition size Is 4 GB, each cluster will be 32 K. Even If a file needs only 10 K, the entire 32 K will be allocated, resulting In 22 K of___________.

Options

  • ASlack space
  • BDeleted space
  • CCluster space
  • DSector space

How the community answered

(18 responses)
  • A
    89% (16)
  • B
    6% (1)
  • C
    6% (1)

Explanation

Slack space (also called file slack) is the unused storage space that exists between the end of a file's actual data and the end of the last cluster allocated to that file. File systems allocate storage in fixed-size units called clusters. If a file only uses part of a cluster, the remaining unused bytes in that cluster are wasted - this waste is called slack space. In this example, a 32 KB cluster is allocated for a 10 KB file, leaving 22 KB of slack space. This concept is important in digital forensics because slack space can contain remnants of previously deleted data.

Topics

#Slack space#File system allocation#Clusters

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice