nerdexam
GIAC

GCFE · Question #97

How do forensic investigators use slack space to recover data?

The correct answer is B. By examining unallocated disk space for remnants of deleted files. See the full explanation below for the reasoning.

Question

How do forensic investigators use slack space to recover data?

Options

  • ABy retrieving logs of failed login attempts
  • BBy examining unallocated disk space for remnants of deleted files
  • CBy analyzing encrypted files
  • DBy reviewing the file's access permissions

How the community answered

(33 responses)
  • A
    3% (1)
  • B
    73% (24)
  • C
    9% (3)
  • D
    15% (5)

Community Discussion

No community discussion yet for this question.

Full GCFE Practice