What kind of data can be retrieved from unallocated space on a disk?

Unallocated space on a disk, also known as free space, is the area that is not currently assigned to any file or system resource. When files are deleted, the space they occupied becomes unallocated but the data may still physically remain on the disk until that space is overwritten by new data.

In this context, deleted files and residual data that has not yet been overwritten can be retrieved from unallocated space. This means that tools used in digital forensics are capable of recovering fragments of files that were deleted, as well as remnants of data from applications that have been previously used. These tools scan the unallocated space to identify patterns that correspond to previously stored files, enabling the recovery of information that the user might believe is permanently lost.

The other answers do not accurately represent what can be retrieved from unallocated space. Active files in use wouldn't be found in unallocated space as they occupy allocated space. Temporary system files generally reside in designated areas, not unallocated space. Executable programs, when deleted, might leave traces in unallocated space but they are not a category of data specifically associated with unallocated space unless explicitly deleted and not overwritten. Thus, the focus on deleted files and residual data makes this option the correct choice.