Computer Hacking Forensic Investigator (CHFI v10) — Question 345

When operating systems mark a cluster as used but not allocated, the cluster is considered as _________

Answer options

• A. Corrupt
• B. Bad
• C. Lost
• D. Unallocated

Correct answer: C

Explanation

The correct answer is 'Lost' because it describes a cluster that the system recognizes as in use but cannot properly allocate for storage. The other options do not accurately define this state, as 'Corrupt' and 'Bad' imply a malfunction, while 'Unallocated' suggests that the cluster has not been marked for any use.