EC-Council
312-49V9 · Question #312
In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?
The correct answer is D. one who has lots of allocation units per block or cluster. See the full explanation below for the reasoning.
Question
In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?
Options
- Aone who has NTFS 4 or 5 partitions
- Bone who uses dynamic swap file capability
- Cone who uses hard disk writes on IRQ 13 and 21
- Done who has lots of allocation units per block or cluster
How the community answered
(59 responses)- A3% (2)
- B5% (3)
- C14% (8)
- D78% (46)
Community Discussion
No community discussion yet for this question.