CHFI Storage Forensics and File System Analysis Practice Question
A forensic examiner finds a file on an NTFS volume that appears to have data hidden in its alternate data stream. The file's size is reported as 10 KB, but the volume's cluster size is 4 KB. How many clusters of file slack could potentially contain hidden data in the primary stream?
⚠ Common exam trap
EC-Council CHFI often tests the distinction between allocated space and slack space, and the trap here is that candidates mistakenly calculate the total allocated clusters (12 KB) as slack instead of subtracting the actual file size from the allocated space.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
2 KB
The file's primary stream occupies 10 KB, which requires 3 clusters (3 × 4 KB = 12 KB). The slack space is the unused portion of the last cluster: 12 KB - 10 KB = 2 KB. This 2 KB of file slack in the primary stream could potentially contain hidden data, making option C correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
12 KB
Why it's wrong here
Selecting 12 KB confuses the total allocated cluster count (3 clusters × 4 KB = 12 KB) with the slack amount itself. For a 10 KB file, the filesystem must allocate three full clusters, yielding 12 KB total; however, slack refers only to the unused 2 KB within the last cluster, not the entire allocated space. This answer conflates allocation size with residue, ignoring that the first two clusters are fully consumed.
- ✗
4 KB
Why it's wrong here
A slack value of 4 KB would occur if an entire final cluster remained unused, such as when a file's size is exactly one full cluster less than its allocation. Here, though, the file is 10 KB, which uses 2 KB of the third cluster; the leftover is 2 KB, not a full cluster. This option likely arises from thinking the last cluster contributes no data or from rounding the file size up improperly.
- ✓
2 KB
Why this is correct
The file size is 10 KB, and NTFS uses 4 KB clusters on this volume. The file consumes two full clusters (8 KB) and then 2 KB of a third cluster, leaving 2 KB of slack in that final cluster. This remaining space is not part of the file size but is still allocated to the file, and it may contain remnants of previously stored data that a forensic examiner should analyze.
- ✗
0 KB
Why it's wrong here
Zero slack would require the file size to be an exact multiple of the cluster size, with the last cluster completely filled. For a 10 KB file on a 4 KB cluster system, 10 is not divisible by 4, so the third cluster is only half-used; 2 KB of it is slack. A zero answer also disregards the forensic reality that filesystem allocation is always in whole clusters.
Go deeper
Related to this question
About these practice questions
This CHFI question is part of Courseiva's 205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.