During an investigation, an employee was found to have deleted harassing emails that were sent to someone else. The company was using Microsoft Exchange and had message tracking enabled. Where could the investigator search to find the message tracking log file on the Exchange server?
In Microsoft Exchange, the message tracking logs are typically stored in the 'Message Tracking' folder within the 'Exchsrvr' directory on the Exchange server. The common file path for these logs would be C:\Exchsrvr\Message Tracking\servername.log, where 'servername' represents the name of the Exchange server. This directory is where one would generally look to find the message tracking log files for investigation purposes.
A: The locations of the log files are configurable, but by default, message tracking logs are stored in the Exchange server installation location; specifically: For Exchange 2003: C:\Program Files\Exchsrvr\<ServerName>.log For Exchange 2007: C:\Program Files\Microsoft\Exchange Server\TransportRoles\ Logs\MessageTracking.
C:\Exchsrvr\Message Tracking\servername.log. In Microsoft Exchange, message tracking logs are stored in the Message Tracking folder located in the Exchsrvr folder on the Exchange server. The file path for the message tracking log file is typically C:\Exchsrvr\Message Tracking\servername.log, where "servername" is the name of the Exchange server.
By default, the message tracking log files exist in %ExchangeInstallPath%TransportRoles\Logs\MessageTracking. The folder contains log files with different names, following the convention MSGTRKServiceyyyyMMdd-nnnn.log. These logs record mail activity as messages flow through the transport pipeline on Mailbox servers and Edge Transport servers. To search these logs, the investigator can use the Get-MessageTrackingLog cmdlet in the Exchange Management Shell or explore the Delivery reports tab in the Exchange admin center12. So, the correct answer is C. C:\Exchsrvr\Message Tracking\servername.log.
This is a very outdated question. The sole correct answer for old 2003 Exchange server directory is: A - C:\Program Files\Exchsrvr\<ServerName>.log I can't find any information about "message tracking" in CHFI v10 book. On Microsoft Learn site I found: %ExchangeInstallPath%TransportRoles\Logs\MessageTracking. So answers B,C and D are not correct at all. That's why I propose answer A is the correct outdated answer for outdated question. https://learn.microsoft.com/en-us/exchange/mail-flow/transport-logs/message-tracking?view=exchserver-2019
This is a very outdated question. The sole correct answer for old 2003 Exchange server directory is: A - C:\Program Files\Exchsrvr\<ServerName>.log I can't find any information about "message tracking" in CHFI v10 book. On Microsoft Learn site I found: %ExchangeInstallPath%TransportRoles\Logs\MessageTracking. So answers B,C and D are not correct at all. That's why I propose answer A is the correct outdated answer for outdated question. https://learn.microsoft.com/en-us/exchange/mail-flow/transport-logs/message-tracking?view=exchserver-2019
All of these answers are incorrect according to quick Google search, but if I had to guess I would say 'c' is the closest to being accurate. I suspect this question is very old and outdated.