In a forensic examination of hard drives for digital evidence, what type of user is most likely to have the most
file slack to analyze?
A.
one who has NTFS 4 or 5 partitions
B.
one who uses dynamic swap file capability
C.
one who uses hard disk writes on IRQ 13 and 21
D.
one who has lots of allocation units per block or cluster