86.1k views
0 votes
Why is the unallocated space of a Windows system so important to a forensic investigator?

User Fran Hoey
by
7.7k points

1 Answer

2 votes

Answer:

Unallocated space can potentially contain all of these types of files and evidence, either completely or partially as fragments, which can remain untouched for long periods of time, even years after the deletion or activity. This data and evidence cannot be viewed by an ordinary computer user, but can be recovered and examined with specialized forensic software and the expertise of a forensic investigator .

Hope this helps :))

User Tgdavies
by
6.8k points