CHFI Storage Forensics and File System Analysis Practice Question
An investigator notes that a file on an NTFS volume has a resident data size of 900 bytes, but the $DATA attribute lists an allocated size of 1024 bytes. What does this indicate?
⚠ Common exam trap
A common misconception is that a resident data size smaller than allocated size implies the file is resident in the MFT, but in reality, resident files have an allocated size of 0, and a non-zero allocated size indicates non-resident storage with potential slack space.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The file has slack space that may contain remnants of previously deleted data
On an NTFS volume, when a file's data is stored as a resident attribute within the MFT, the $DATA attribute's allocated size is typically 0 because the data occupies space only within the MFT record itself. Here, the allocated size is 1024 bytes, which is larger than the resident data size of 900 bytes. This indicates that the file is stored non-resident (i.e., in clusters outside the MFT), and the allocated size reflects the cluster size (e.g., 1024 bytes per cluster). The difference between the allocated size (1024 bytes) and the actual data size (900 bytes) is slack space, which may contain remnants of previously deleted data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The file is compressed using NTFS compression
Why it's wrong here
NTFS compression reduces the number of clusters allocated to a file by compressing data within compression units, but it does not create the unused tail bytes inside the final cluster that constitute slack space. Slack is a function of cluster alignment: any file whose logical length is not a multiple of the cluster size leaves a remainder in the last cluster. A compressed file's allocated size can be much smaller than its uncompressed size, yet the residual bytes in its last allocated cluster still arise from the same EOF alignment, not from compression. Therefore, compression would change allocated cluster counts, but it would not explain the presence of slack containing remnants of deleted data.
- ✓
The file has slack space that may contain remnants of previously deleted data
Why this is correct
File slack occurs because NTFS allocates disk space in fixed-size clusters, while a file's logical size is measured in bytes. If the final cluster is only partially used, the remaining bytes from the end of the file to the end of that cluster are not initialized by the filesystem, so they may still contain data from a previously deleted file or from an earlier, larger version of the current file. This residual data is a common forensic target because it survives normal file deletion and can be carved during analysis. The observed discrepancy between allocated size and logical size directly indicates that such slack space exists.
- ✗
The file's data is stored in the MFT as a resident attribute
Why it's wrong here
When a file's data is stored as a resident attribute, its content is embedded inside the MFT record itself, not in any allocated cluster on the volume. Resident files are typically small enough to fit in the record, and they have no data runs, so there is no cluster boundary to create slack. The forensic artifact for a resident file would be residual data in previously unused portions of the MFT record, not slack space attached to an allocated cluster. Thus, resident data is a fundamentally different storage mode and cannot account for a cluster-level slack observation.
- ✗
The file is stored in an alternate data stream
Why it's wrong here
An alternate data stream (ADS) is a separate named stream associated with the same MFT entry, and it has its own independent size and cluster allocation. If an ADS exists, it consumes its own clusters, so it would not manifest as slack inside the main file's allocated space; rather, it appears as an additional allocation beyond the main stream. Forensic tools show ADSes as distinct streams with their own data, whereas slack is raw unused bytes within the last cluster of a specific stream. Therefore, an ADS would not create the same kind of size/allocated difference associated with slack.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.