In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most file slack to analyze?
one who has NTFS 4 or 5 partitions
one who uses dynamic swap file capability
one who uses hard disk writes on IRQ 13 and 21
one who has lots of allocation units per block or cluster
Submit