File slack
The unused space at the tail of the last cluster of a file. It can contain remnants of whatever previously occupied that cluster, including parts of older deleted files. Examined directly with Autopsy or EnCase.
The unused space at the tail of the last cluster of a file. It can contain remnants of whatever previously occupied that cluster, including parts of older deleted files. Examined directly with Autopsy or EnCase.
Practice with mock tests, learn from structured notes, and get your questions answered by a global forensic community, all in one place.