Which among the following files provides email header information in the Microsoft Exchange server?

The correct answer is B. PRIV.EDB. PRIV.EDB (Private Information Store database) is the core Exchange Server database file that stores all private mailbox data, including emails and their full header information (sender, recipient, routing, timestamps, message IDs). PUB.EDB stores public folder data. PRIV.STM is…

Submitted by fernanda_arg· Apr 18, 2026Disk Forensics

Question

Options

Agwcheck.db
BPRIV.EDB
CPUB.EDB
DPRIV.STM

How the community answered

(38 responses)

B
95% (36)
C
3% (1)
D
3% (1)

Explanation

PRIV.EDB (Private Information Store database) is the core Exchange Server database file that stores all private mailbox data, including emails and their full header information (sender, recipient, routing, timestamps, message IDs). PUB.EDB stores public folder data. PRIV.STM is a streaming store file that holds MIME/raw message body content. gwcheck.db is a Novell GroupWise file unrelated to Exchange. For forensic analysis of email headers in an Exchange environment, PRIV.EDB is the primary artifact.

Topics

#Microsoft Exchange Server#Email Forensics#Database Files#Email Headers

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice