QuestionQ34

Application Protocols

Adam is a professional Computer Hacking Forensic Investigator. He wants to examine a suspicious email sent through a Microsoft Exchange server.

Which of the following files should he review to complete this task?

Each correct answer represents part of the solution. Choose all that apply.

Choose two
  • A Checkpoint files
  • B EDB and STM database files
  • C Temporary files
  • D cookie files
Explanation

Exchange mailbox data is held in database files, including the legacy EDB and STM store files. Exchange checkpoint files record which logged transactions have been written to the on-disk database, making them relevant supporting files for examining the state and recovery of Exchange store evidence. Temporary files and browser cookie files are not the relevant Exchange mailbox-store files.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!