After suspecting a change in MS-Exchange Server storage archive, the investigator has analyzed it. Which of the following components is not an actual part of the archive?

The correct answer is D. PUB.STM. Microsoft Exchange Server (2000/2003) stores mailbox data in two primary database files per store: a .EDB (Extensible Storage Engine database) file and a .STM (streaming) file. The recognized archive components are PRIV.EDB (private mailbox store database), PRIV.STM (private…

Submitted by kevin_r· Apr 18, 2026Disk Forensics

Question

Options

APRIV.STM
BPUB.EDB
CPRIV.EDB
DPUB.STM

How the community answered

(28 responses)

A
4% (1)
B
4% (1)
C
7% (2)
D
86% (24)

Explanation

Microsoft Exchange Server (2000/2003) stores mailbox data in two primary database files per store: a .EDB (Extensible Storage Engine database) file and a .STM (streaming) file. The recognized archive components are PRIV.EDB (private mailbox store database), PRIV.STM (private mailbox store streaming file), and PUB.EDB (public folder store database). PUB.STM is not recognized as an actual distinct archive component in the Exchange storage structure covered by this exam domain, making it the odd one out.

Topics

#Exchange Server#Database Files#Storage Architecture#Forensic Artifacts

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice