Which artifact is most likely to retain remnants of deleted data on a bitmap image?

Which artifact is most likely to retain remnants of deleted data on a bitmap image?

• A. Unallocated space
• B. Recycle bin
• C. Slack space
• D. System restore points

Answer: (C)

The key idea is that data remnants tend to hide in slack space within a file. When a bitmap image is stored on disk, its data occupies whole clusters, and the final cluster used by the file may not be completely full. The unused portion of that last cluster is slack space. If parts of the image were deleted or overwritten in a later edit, the bytes left in this slack area are not automatically erased, so older pixel data or metadata can survive there. This makes slack space the most likely place to find remnants of deleted data embedded inside the bitmap image itself. Unallocated space is outside the file’s current allocation and can contain remnants from other deleted files, but it isn’t within the bitmap image. The Recycle Bin stores whole deleted files as separate items, not residual data inside the bitmap. System restore points are entire system snapshots and not focused on a single image’s residual data.

The key idea is that data remnants tend to hide in slack space within a file. When a bitmap image is stored on disk, its data occupies whole clusters, and the final cluster used by the file may not be completely full. The unused portion of that last cluster is slack space. If parts of the image were deleted or overwritten in a later edit, the bytes left in this slack area are not automatically erased, so older pixel data or metadata can survive there. This makes slack space the most likely place to find remnants of deleted data embedded inside the bitmap image itself.

Unallocated space is outside the file’s current allocation and can contain remnants from other deleted files, but it isn’t within the bitmap image. The Recycle Bin stores whole deleted files as separate items, not residual data inside the bitmap. System restore points are entire system snapshots and not focused on a single image’s residual data.