GCIA: GIAC Certified Intrusion AnalystDemo

By GIAC · Question Mode

QuestionQ241

Network Forensics and Traffic Analysis

Which of the following statements is NOT true regarding file slack space in the Windows operating system?

  • A File slack is the space, which exists between the end of the file and the end of the last clust er.
  • B Large cluster size will decrease the volume of the file slack.
  • C File slack may contain data from the memory of the system.
  • D It is possible to find user names, passwords, and other important information in slack.
Explanation

File slack is the unused portion of a file’s last allocated cluster. Increasing cluster size generally increases the possible amount of unused space in that cluster, so it does not decrease file slack. Slack space can retain residual memory or previously stored data, including sensitive information.

Community Discussion

No comments yet. Be the first to start the discussion!