Question

Slack space most commonly contains visible data. True or False

Answer 1

Is this computer forensics? The answer depends on the file system in use. There are a few that change the common way we think how slack space works. If we ignore that, slack space is basically considered the left over space after a file has been written to an allocation unit (cluster). I would say the answer is false as to my understand that visible data is data that is not wasted; however, slack space is great when coding algorithms to search for specific things. (i.e. <HEADER> <EOF> <SLACK SPACE> [basically] more parameter increase accuracy.)