The correct answers are A and C.
OBJ-4.4: Files that users have deleted are most likely found in the Recycle Bin or slack space. Slack space is the space left after a file has been written to a cluster. Slack space may contain remnant data from previous files after the pointer to the files was deleted by a user. Unallocated space has not been partitioned and, therefore, would typically not have been written to. The registry will not store files that have been deleted but may contain a reference to the file, such as the file’s name.