Computer Hacking Forensic Investigator (CHFI v10) — Question 112

During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled. Where could the investigator search to find the message tracking log file on the Exchange server?

Answer options

• A. C:\Program Files\Exchsrvr\servername.log
• B. D:\Exchsrvr\Message Tracking\servername.log
• C. C:\Exchsrvr\Message Tracking\servername.log
• D. C:\Program Files\Microsoft Exchange\srvr\servername.log

Correct answer: A

Explanation

The correct answer is A because the message tracking log files for Microsoft Exchange are typically located in the 'C:\Program Files\Exchsrvr' directory. The other options (B, C, and D) refer to incorrect paths that do not align with the standard location for these log files in an Exchange environment.