CHFI Storage Forensics and File System Analysis Practice Question
During an investigation, an analyst recovers a file from unallocated space that contains fragments of a deleted document. The file size is 512 bytes, but the cluster size of the volume is 4096 bytes. What is the term for the unused bytes between the end of the file and the end of the last cluster?
⚠ Common exam trap
EC-Council often tests the distinction between RAM slack and file slack, and the trap here is that candidates confuse 'file slack' with 'RAM slack' because both involve unused bytes, but file slack encompasses the entire cluster remainder, while RAM slack is only the sector-level portion.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
File slack
File slack refers to the unused bytes between the end of a file and the end of the last cluster allocated to that file. In this scenario, the file is 512 bytes but resides in a 4096-byte cluster, leaving 3584 bytes of slack space. This area can contain remnants of previously deleted data or metadata, making it a critical forensic artifact.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Volume slack
Why it's wrong here
Volume slack is the unused space that exists after the logical volume's end but before the physical partition's end, created when a volume is created smaller than its partition. During file recovery, data in volume slack is not associated with a file's allocated cluster or its slack space. It is a partition-level artifact, not a per-file allocation artifact, so it cannot describe the unused bytes between the end of a recovered file and the end of its last cluster.
- ✗
Drive slack
Why it's wrong here
Drive slack is not an accepted or standardized term in forensic science; the recognized slack-space categories are RAM slack and file slack, which reside within a file's final allocated cluster. 'Drive slack' is sometimes colloquially used to refer to unallocated space or partition gaps, but those are separate storage regions, not the leftover bytes in a file's last cluster. Since it has no fixed definition, it is incorrect to select it as the specific artifact containing the remnant data.
- ✓
File slack
Why this is correct
File slack is the unused bytes from the logical end of a file to the end of the last cluster allocated to that file, and it is the correct location for recovered remnant data. It consists of RAM slack (up to the sector boundary) plus the remaining bytes in the trailing cluster, which are typically not zeroed by the filesystem. Because old data can persist there after a file is overwritten or deleted, forensic examiners regularly recover intact fragments from file slack.
- ✗
RAM slack
Why it's wrong here
RAM slack is specifically the small gap from the end of the file's logical data to the end of the current 512-byte sector, created when the file is written into memory buffers. This is only a tiny subset of file slack—usually less than one sector—whereas file slack continues to the cluster boundary. If the recovered data came from beyond the final sector, it would reside in the remaining file slack, not RAM slack, making RAM slack an incomplete and incorrect choice.
Go deeper
Related to this question
About these practice questions
One of 205 original CHFI practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.