In digital forensics, Slack Space refers to leftover storage that exists when a file does not need all the space allocated by the operating system.

• A. Clusters
• B. Slack Space
• C. Platter
• D. Sectors

Answer: (B)

The concept tested is how unused space within a file’s allocated storage is handled. When a file is stored, the filesystem allocates fixed-size blocks called clusters. If the file’s actual data doesn’t fill the last cluster completely, the remaining bytes in that final cluster are slack space. That slack space can still contain remnants of data, metadata, or artifacts from prior activity, which is why it’s important in digital forensics to analyze.

Clusters are the actual storage units used to allocate space for files, so they’re related but not the leftover area itself. Sectors are smaller addressable units on a disk, while slack space specifically refers to the unused portion of the last cluster. A platter is the physical disk surface, not a data-storage concept used in this context.