What advantage does the tool Evidor have over the built-in Windows search?

• A. It can find deleted files even after they have been physically removed
• B. It can find bad sectors on the hard drive
• C. It can search slack space
• D. It can find files hidden within ADS

Answer: (C)

Slack space is the unused portion of a disk cluster where remnants of previously stored data can linger. A forensic tool like Evidor can scan this raw disk space, not just the files and metadata indexed by the operating system. Because Windows search looks at file contents and attributes, it generally won’t examine slack space for hidden or remnants of data. By probing slack space, Evidor can uncover fragments or remnants from deleted or overwritten data that would be invisible to normal search, giving investigators access to evidence that Windows search would miss.