In a forensic examination of hard drives, which type of user would have the most file slack to analyze?

• A. One who has NTFS 4 or 5 partitions
• B. One who uses dynamic swap file capability
• C. One who uses hard disk writes on IRQ 13 and 21
• D. One who has lots of allocation units per block or cluster

Answer: (D)

Slack space is the unused portion of the last cluster allocated to a file. When a file doesn’t end exactly on a cluster boundary, the trailing bytes in that final cluster remain slack and can hold remnants of data. The amount of slack per file depends on the cluster size used by the file system—the larger the cluster size, the bigger the potential slack in each file. If a user’s disk uses a large cluster size (many allocation units per cluster), each file is more likely to leave a sizable amount of slack behind, increasing the data accessible for forensic analysis. The other options don’t directly affect how much slack a file can leave; they’re about partition type, swap behavior, or hardware interrupts, none of which determine the amount of slack in the last cluster.