GIAC
GCFE · Question #97
How do forensic investigators use slack space to recover data?
The correct answer is B. By examining unallocated disk space for remnants of deleted files. See the full explanation below for the reasoning.
Question
How do forensic investigators use slack space to recover data?
Options
- ABy retrieving logs of failed login attempts
- BBy examining unallocated disk space for remnants of deleted files
- CBy analyzing encrypted files
- DBy reviewing the file's access permissions
How the community answered
(33 responses)- A3% (1)
- B73% (24)
- C9% (3)
- D15% (5)
Community Discussion
No community discussion yet for this question.