Computer Hacking Forensic Investigator (CHFI v10) — Question 255

NTFS has reduced slack space than FAT, thus having lesser potential to hide data in the slack space. This is because:

Answer options

• A. FAT does not index files
• B. NTFS is a journaling file system
• C. NTFS has lower cluster size space
• D. FAT is an older and inefficient file system

Correct answer: C

Explanation

The correct answer is C because NTFS utilizes a smaller cluster size, which reduces the amount of slack space available for hiding data. Options A and B do not directly relate to the issue of slack space, while D, while true, does not explain the specific reason for the lesser slack space in NTFS.