CHFI Storage Forensics and File System Analysis Practice Question
What is slack space in a file system?
⚠ Common exam trap
EC-Council often tests the distinction between slack space and unallocated space; the trap is that candidates confuse the unused portion of a file's last cluster (slack) with free space on the disk (unallocated), leading them to pick Option D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The unused portion of a file's last cluster
Slack space is the unused portion of the last cluster allocated to a file. When a file does not exactly fill its final cluster, the remaining bytes in that cluster are slack space, which can contain remnants of previously deleted data. This is a critical area in file system forensics because it may hold hidden evidence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Space used by the file system journal
Why it's wrong here
The file system journal is a dedicated region or file (such as the ext3/4 journal or NTFS $LogFile) that records metadata and data transaction logs for crash recovery. It is reserved by the file system itself and is not part of the clusters allocated to user files. Slack space arises within a file's final cluster after the logical file length, whereas journal space is a separate on-disk structure that never becomes free bytes inside a file's allocation.
- ✓
The unused portion of a file's last cluster
Why this is correct
File slack, also known as cluster slack, is exactly the unused portion of the last cluster assigned to a file. When a file's logical size is not an exact multiple of the cluster size, the file system allocates a full cluster but only writes data up to the end of the file, leaving the remaining bytes in that cluster uninitialized. This residual space is significant in digital forensics because it may contain remnants of previously deleted files or other data that were not overwritten by the current file's content.
- ✗
Space reserved for the MBR
Why it's wrong here
The Master Boot Record (MBR) is a 512-byte sector located at LBA 0, containing boot code and the partition table. It is a system-level structure that exists outside the file and cluster allocation mechanisms, not leftover bytes within an allocated cluster. Slack space is a file-level artifact occurring inside a file's last cluster, while the MBR is a fixed disk-level structure that is never considered slack regardless of its unused fields.
- ✗
Space between partitions on a disk
Why it's wrong here
Space between partitions, often called partition gap or volume slack, is the unallocated region on a disk that lies between the end of one partition and the beginning of the next, typically due to partition alignment or geographies. It is a disk-layout concept that exists at the partition level, not within any individual file's cluster chain. In contrast, file slack exists inside the last cluster of a file and is a direct result of the difference between logical file length and the cluster's fixed size, making these two concepts distinct.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 745 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.