Question

During a forensic investigation, Shelly is told to look for information in slack space on the drive. Where should she look, and what is she likely to find?

A. She should look at unallocated space, and she is likely to find file fragments from deleted files.
B. She should look at unused space where files were deleted, and she is likely to find complete files hidden there by the individual being investigated.
C. She should look in the space reserved on the drive for spare blocks, and she is likely to find complete files duplicated there.
D. She should look at unused space left when a file is written, and she is likely to find file fragments from deleted files.

Answer 1

Shelly should look in the unused space left when a file is written, known as slack space, where she is likely to find remnants of deleted files.

Step-by-step explanation:

During a forensic investigation, when Shelly is told to look for information in slack space, she should look at unused space left when a file is written to a disk cluster. The correct option is indeed D. When files are saved, they often do not perfectly fit into the fixed-sized storage blocks, or clusters, on a drive. The leftover space is known as slack space. It can contain file fragments from previously deleted files or data remnants from earlier versions of the files that currently occupy the adjoining space. So in slack space, Shelly is likely to find remnants of deleted files that could provide valuable clues in a forensic investigation. This is due to the fact that the operating system does not usually erase or overwrite this slack space until it is necessary to store another file that needs that space to fit into a cluster.