Computer Hacking Forensic Investigator (CHFI) v11 Practice Test

The main idea is to separate where email evidence lives and what it contains. Local archives are the copies of mailbox data kept by the email client on a local device—think PST/OST files or downloaded emails stored on a user’s computer. Server storage archives are the data housed on the mail server itself, including the actual mailbox contents, folders, and the server’s configuration and logs that govern how mail is stored and accessed.

Why this answer fits best: it clearly identifies that server storage archives involve server-side data and settings, which you would typically access or image from the server, while local archives involve the client’s data stored on the local system. This distinction is essential for proper evidence collection and chain of custody, since local client data can be altered on the device, whereas server data reflects the server’s state (though both require careful handling to preserve integrity).

The other statements rely on assumptions that aren’t universally true—for example, that local archives have no evidentiary value, or that you must always store local and server archives together for admissibility, or that dealing with webmail has no offline archive. Those aren’t reliable general rules, whereas understanding the separation between client-side local archives and server-side server storage archives is the correct framework.