When adding data to FTK, which statement about DriveFreeSpace is true?

Question

Options

• ADriveFreeSpace is merged with deleted files.
• BDriveFreeSpace is segmented into 10 megabyte items.
• CDriveFreeSpace is truncated, based on the size of the case.dat file.
• DDriveFreeSpace is classified with file slack items in the Overview tab.

• B
  3% (1)
• C
  6% (2)
• D
  91% (30)

Explanation

In FTK's Overview tab, DriveFreeSpace (unallocated drive space) is grouped alongside file slack items because both represent areas of a storage device that fall outside active file system allocation - making them logical companions for forensic review. Option A is wrong because deleted files are tracked separately from unallocated space; they retain metadata and appear in their own category. Option B is incorrect because FTK does not automatically segment DriveFreeSpace into 10 MB chunks - that figure is fabricated. Option C is wrong because the case.dat file size does not control truncation of DriveFreeSpace; that would be an unusual and unreliable design.

Memory tip: Think of it this way - both file slack and drive free space are "leftovers" that no active file currently owns, so FTK bundles these two "orphan space" types together in the Overview tab.

No community discussion yet for this question.