Cengage Computer Forensics Practice Test

Which type of disk space often contains recoverable remnants of deleted files, making data carving possible?

Unallocated space Allocated space System reserved space Cache space

Correct Answer:

Unallocated space

Explanation:

When a file is deleted, the filesystem only marks the space it used as free, but the actual bytes often remain on disk until they’re overwritten. That means the area of the disk not currently assigned to any active file—unallocated space—can still contain remnants of deleted data. Data carving uses this raw data, scanning for known file signatures to reconstruct files from those leftovers. In contrast, allocated space holds live files, so their data is more likely to be in use or overwritten; system reserved space contains boot and metadata areas, not user data; and cache space holds temporary data that can be overwritten quickly, making reliable carving less likely.

Access more questions from this quiz

Continue to Cengage Computer Forensics Practice Test for more practice questions and the full quiz experience.

Access More Questions