Exchange

Exchange Log Files

Compound
3 paths from 3 artifacts
Version 1.1
Keith Twombley

Paths on disk

3 paths from 3 targets

Includes 3 targets

Each one is collected with this target

ExchangeClientAccess1 path
ExchangeTransport1 path
ExchangeSetupLog1 path

Collect it

KAPE command line for Exchange

Source

Destination

--vss--vhdx

kape.exe --tsource C: --tdest D:\Evidence --target Exchange

Note: This is a compound target that references 3 other targets. The KAPE command resolves them natively; the PowerShell/Batch/WSL scripts flatten every referenced path into explicit copy commands.

Run with administrator privileges. KAPE Documentation