Adam works as a professional Computer Hacking Forensic Investigator. He wants to investigate a suspicious email that is sent using a Microsoft Exchange server. Which of the following files will he…

Checkpoint files record which transaction log files have been committed to the Exchange database, providing investigators a timeline of database state changes critical for reconstructing events.

EDB files hold all mailbox and public folder data while STM files store native internet-format message content, making them the primary evidence sources for email forensics on an Exchange server.

Temporary files created by Exchange during message processing may retain fragments of messages or metadata not yet flushed to the primary database, yielding additional forensic artifacts.

Cookie files are client-side browser artifacts stored on end-user machines and have no relationship to Exchange server-side email storage or transaction logs.