Where could the investigator search to find the message tracking log file on the Exchange server?

• A. C:\Program Files\Exchsrvr\servername.log
• B. D:\Exchsrvr\Message Tracking\servername.log
• C. C:\Exchsrvr\Message Tracking\servername.log
• D. C:\Program Files\Microsoft Exchange\srvr\servername.log

Answer: (A)

Message tracking logs are stored on the Exchange server in the installation directory, with a simple naming convention: the log file is named after the server and has a .log extension. The default location is C:\Program Files\Exchsrvr\servername.log, which matches the given path. This location reflects the standard setup where logs sit in the Exchange program files area and are easily accessible for forensic review.

The other paths would only be correct if an administrator customized the log path, such as placing logs on another drive or under a subfolder like "Message Tracking." Since the question is asking for the default location, the path in the program files directory is the most appropriate choice.