Adam works as a professional Computer Hacking Forensic Investigator. A project has been assigned to him to investigate computer of an unfaithful employee of SecureEnet Inc. Suspect's computer runs on

Allocated clusters contain active, currently referenced file system data that is directly accessible through normal OS and user operations, so they do not represent a specialized or hidden forensic artifact source in the same way that slack space, swap files, or hidden partitions do.

Swap files (pagefile.sys on Windows) serve as virtual memory and can contain fragments of documents, passwords, encryption keys, and process memory that were never written to disk as discrete files. This makes them a critical source of volatile evidence that survives after the processes that created the data have terminated. A forensic examiner can parse the pagefile to recover artifacts that would otherwise be unavailable.

Slack space is the unused area between the logical end of a file and the physical end of its allocated cluster; remnants of previously stored data can persist in this region even after the original file was deleted. Because the OS does not clear slack space when a new, smaller file occupies a cluster, it becomes an important location for recovering overwritten evidence. Forensic tools like FTK and EnCase specifically analyze slack space during examinations.

Unused and hidden partitions can store data that the suspect deliberately concealed outside the primary file system, including contraband files, encrypted containers, or artifacts from deleted partitions. These areas are not mounted by default and are invisible to standard OS tools, requiring forensic imaging of the entire physical drive to discover and analyze them.