Which statement best describes Slack space in a file system?

• A. The portion of a cluster not used by the file in the last cluster
• B. Space used by deleted files
• C. Space reserved for metadata
• D. Space used by the master file table

Answer: (A)

Slack space is the unused portion of the final cluster allocated to a file, created because file data is stored in fixed-size units called clusters. A file’s data often doesn’t end exactly at a cluster boundary, so the last cluster contains some unused bytes. That leftover area belongs to the file’s allocation and can hold remnants of prior data, which is why it’s of forensic interest. This description fits best because it directly refers to the unused part of the last cluster. It isn’t space used by deleted files (that would be free or unallocated space), nor metadata space, nor space used by the master file table.