Computer Hacking Forensic Investigator (CHFI v10) — Question 317

After suspecting a change in MS-Exchange Server storage archive, the investigator has analyzed it. Which of the following components is not an actual part of the archive?

Answer options

• A. PRIV.STM
• B. PUB.EDB
• C. PRIV.EDB
• D. PUB.STM

Correct answer: D

Explanation

The correct answer is D, PUB.STM, as it is not a component of the storage archive for MS-Exchange Server. The other options, PRIV.STM, PUB.EDB, and PRIV.EDB, are all valid files associated with the database and storage architecture of the server.