QUESTION 4 In a FAT system, the unallocated clusters from the point of view of forensics do not exist exist but have all zeros in them. retain data from previous allocations and are very usetul therefore. retain data from previous allocations, are useless therefore. QUESTION The main purpose of volatility framework is to analyze hard disks to acquire memory data for forensics to provide test data for analysis. to analyze memory data acquired using another tool. QUESTION 6 NTFS allows storage of sparse fies without large groups of zeros being stored as zeros just like FAT system which makes forensics of sparse files a difficult task which actually does not save space. which makes forensics easier