Question 399 of 205
Types of Slack Space in Forensic Investigations
Which THREE of the following are types of slack space that can contain hidden data on a hard disk?
Quick Answer
The answer is RAM slack, file slack, and volume slack. These three are the recognized types of slack space that can contain hidden data on a hard disk because they represent unallocated or unused storage areas created by the way the operating system writes data to clusters. RAM slack occurs when a file does not fill the last sector of a cluster, leaving residual data from system memory, while file slack is the unused space between the end of the file and the end of the cluster, and volume slack is the leftover space at the end of a volume that is not partitioned. On the Computer Hacking Forensic Investigator CHFI exam, this question tests your ability to distinguish between actual slack space and hidden disk areas like HPA and DCO, which are separate reserved regions, not slack. A common trap is confusing HPA and DCO with slack, so remember that slack is always within the normal file system structure, whereas HPA and DCO are hidden at the firmware level. A useful memory tip: think of the three S’s—Sector, Space, and Sliver—for RAM slack (sector-level), file slack (space within a cluster), and volume slack (sliver at the volume’s end).
⚠ Common exam trap
The EC-Council CHFI exam often tests the distinction between hidden disk areas (like HPA and DCO) and true slack space types (file, volume, RAM slack), causing candidates to mistakenly classify HPA or DCO as slack space.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
File slack
File slack (C) is correct because it refers to the unused space between the end of a file's data and the end of the allocated cluster. This area can contain remnants of previous file data or intentionally hidden data, and is a standard forensic artifact in file system analysis (e.g., NTFS or FAT).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Device Configuration Overlay
Why it's wrong here
DCO is a hidden area, not slack space.
- ✗
Host Protected Area
Why it's wrong here
HPA is a hidden area, not slack space.
- ✓
File slack
Why this is correct
File slack is the unused space between the end of a file and the end of the last cluster.
- ✓
Volume slack
Why this is correct
Volume slack is the unused space at the end of a partition.
- ✓
RAM slack
Why this is correct
RAM slack is the space between the end of a file and the end of the sector.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which TWO of the following are types of slack space that can contain forensic evidence?
easy- ✓ A.Volume slack
- B.Index slack
- C.Swap space
- D.Buffered slack
- ✓ E.RAM slack
Why A: Volume slack is the unused space between the end of the file system and the end of the partition. When a partition is smaller than the volume it resides on, the remaining space (volume slack) can contain remnants of previously stored data, making it a valuable source of forensic evidence.
Last reviewed: Jul 4, 2026
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.