Computer Hacking Forensic Investigator (CHFI) — Question 50

Which of the following refers to the data that might still exist in a cluster even though the original file has been overwritten by another file?

Answer options

• A. Sector
• B. Metadata
• C. MFT
• D. Slack Space

Correct answer: D

Explanation

The correct answer is D, Slack Space, which refers to the unused space in a file system cluster that can still hold remnants of data from previously deleted or overwritten files. Options A, B, and C do not specifically denote this phenomenon; a Sector is a basic unit of storage, Metadata describes data about data, and MFT refers to the Master File Table in NTFS, none of which address the issue of residual data after file overwriting.