U.S. Independence Day Deal! Unlock 25% OFF Today – Limited-Time Offer - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions

Eccouncil 312-49 Exam - Topic 12 Question 94 Discussion

Adam, a forensic investigator, is investigating an attack on Microsoft Exchange Server of a large organization. As the first step of the investigation, he examined the PRIV.EDB file and found the source from where the mail originated and the name of the file that disappeared upon execution. Now, he wants to examine the MIME stream content. Which of the following files is he going to examine?
A) PRIV.STM
B) gwcheck.db
C) PRIV.EDB
D) PUB.EDB

Eccouncil 312-49 Exam - Topic 12 Question 94 Discussion

Actual exam question for Eccouncil's 312-49 exam
Question #: 94
Topic #: 12
[All 312-49 Questions]

Adam, a forensic investigator, is investigating an attack on Microsoft Exchange Server of a large organization. As the first step of the investigation, he examined the PRIV.EDB file and found the source from where the mail originated and the name of the file that disappeared upon execution. Now, he wants to examine the MIME stream content. Which of the following files is he going to examine?

Show Suggested Answer Hide Answer
Suggested Answer: A

Contribute your Thoughts:

0/2000 characters
Portia
19 hours ago
I’m leaning towards A) PRIV.STM as well, but I wish I had reviewed more about the differences between these file types before the exam.
upvoted 0 times
...
Nan
2 months ago
I’m a bit confused; I thought the MIME content might be in the PRIV.EDB file too, but I guess that’s more for the database itself?
upvoted 0 times
...
Louvenia
2 months ago
I remember practicing a question like this, and I believe the answer is A) PRIV.STM since it handles the streaming content for emails.
upvoted 0 times
...
Edwin
2 months ago
I think the MIME stream content is usually found in the PRIV.STM file, but I'm not entirely sure.
upvoted 0 times
...

Save Cancel