In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?

exams 312-49v9 312-49v9 exam 0 Comments

In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?
A . one who has NTFS 4 or 5 partitions
B . one who uses dynamic swap file capability
C . one who uses hard disk writes on IRQ 13 and 21
D . one who has lots of allocation units per block or cluster

Answer: D