File systems view a cluster as entirely utilized under what circumstance?

---

Hello,

I'm currently studying cybersecurity. However, I have come across this question about clusters. I do not fully understand how file systems view clusters. Any help in understanding this would be greatly appreciated. What my book tells me is that "Clusters are fixed-length blocks of data—one to 128 sectors" and that "Rarely do file sizes exactly match the size of these clusters perfectly. The extra space from the end of the file to the end of the cluster is called file slack. Cluster sizes vary in length, depending on the operating system and the size of the logical partition. Larger cluster sizes have more forensic value. With normal 512-byte sectors, if there is not enough data in the file to fill the last sector in the cluster, DOS or Windows makes up the difference by padding the remaining space with data from the memory buffers"

File systems view a cluster as entirely utilized under what circumstance?

a) If the sector has a size of 4096 bites
b) If even one bit is used
c) If ten sectors are used

Hey @Sara-Setzer great question, I can answer the concept of clusters and sectors for you and will rely on our forensic SMEs to help you in that area.

• Sectors are the smallest unit of storage on a physical storage device. The drive controller sees sectors but file systems do not use them. Clusters, however are the smallest unit of storage that a file system will store data in. This is the reason you might hear clusters called "allocation units". When a file is stored in a cluster the goal is to use as much as the cluster as possible.
• Files will not share clusters, any unused space in a cluster that is not used will be wasted storage space on the storage device.

Let me give you an example:

• You have a file that is 130 KB that you need to store, the file system uses 64KB clusters. The file system will fill up 2 64 KB clusters (128KB) and 1 64 KB cluster that only uses 2 KB of the 64KB cluster, leaving 63 KBs of waste (or unused space in the 3rd cluster, remember files will not share clusters). This might help you to find that right answer to the question you posted.

I hope this helps and I look forward to hearing from our forensics SMEs to help you with applying that to your training.