Exchange Server Logs

Exchange Message Tracking Logs record every email delivery path through the transport pipeline — sender, recipients, subject, message ID, delivery status, and connector used. Combined with SMTP Protocol Logs that capture raw SMTP transactions, these logs enable complete email flow reconstruction for BEC investigations, phishing campaigns, and data exfiltration via email.

What Are Exchange Server Logs?

Microsoft Exchange Server generates two primary log types for forensic analysis: Message Tracking Logs record the complete delivery path of every email message processed by the transport pipeline, and Protocol Logs capture raw SMTP conversation transcripts between Exchange and other mail servers. Together, they provide end-to-end visibility into email delivery, from the moment a message enters the organization to its final delivery (or rejection).

Message Tracking Logs are CSV files containing fields such as date-time, sender-address, recipient-address, message-subject, message-id, event-id (RECEIVE, SEND, DELIVER, FAIL, etc.), source, connector-id, and total-bytes. Each message generates multiple log entries as it passes through transport agents, content filtering, and delivery queues. The message-id field ties all entries for a single message together across multiple log files.

Exchange Online (Office 365) provides equivalent functionality through the Search-MessageTrackingReport cmdlet and the Microsoft 365 Defender message trace feature, though with different retention periods (default 10 days for detailed trace, 90 days for summary data). On-premises Exchange retains message tracking logs for 30 days by default, configurable via Set-TransportService.

Location & Format

Key Message Tracking Fields

What It Reveals

• Complete email delivery timeline — Every stage from reception to delivery, with sub-second timestamps.
• All recipients including BCC — BCC recipients appear in tracking logs even though they are hidden from other recipients.
• Failed deliveries and rejections — Messages blocked by content filters, transport rules, or recipient validation.
• Auto-forwarding rules — REDIRECT events reveal mailbox rules forwarding email to external addresses.
• Distribution list expansion — EXPAND events show which individual recipients received messages sent to distribution groups.
• Message size and attachment indicators — total-bytes identifies messages carrying large attachments.
• Connector and routing path — Which send/receive connectors processed the message, revealing mail flow architecture.
• Journal and compliance copies — JOURNAL events confirm whether messages were captured by journaling rules.

Forensic Use Cases

1. BEC Wire Fraud Investigation

A fraudulent wire transfer request was sent from a compromised vendor email account. Message Tracking Logs show the RECEIVE event for the phishing email, identifying the source IP of the sending server, the SMTP envelope sender, and the exact delivery timestamp. Protocol Logs contain the full SMTP EHLO conversation, revealing the sending server’s hostname and TLS certificate.

2. Insider Email Exfiltration

A departing employee creates a mailbox rule that auto-forwards all received email to a personal Gmail account. Message Tracking Logs show REDIRECT events for every forwarded message, with the external recipient address and timestamps. The source-context field identifies the inbox rule as the cause of the redirect.

3. Phishing Campaign Scope Assessment

After identifying a phishing email, investigators use Get-MessageTrackingLog to search for all messages from the same sender, with the same subject, or with the same Message-ID pattern. This reveals every recipient in the organization who received the phishing email and whether they opened or forwarded it.

4. Data Loss Prevention Audit

DLP transport rules generate tracking log entries when they detect sensitive content (credit card numbers, SSNs, classified markings). Searching for DLP-triggered events reveals which users attempted to send restricted content externally and whether the messages were blocked or allowed.

5. Mailbox Compromise Timeline

During an account compromise, the attacker sends outbound phishing from the victim’s mailbox. Message Tracking Logs establish the exact window of unauthorized sending activity by showing SEND events from the compromised account to external recipients, with source IP addresses identifying the attacker’s infrastructure.

Acquisition Methods

# Search message tracking logs for a specific sender
Get-MessageTrackingLog -Sender "user@company.com" -Start "03/01/2026" -End "03/28/2026" -ResultSize Unlimited | Export-Csv C:\Evidence\tracking.csv

# Search for all messages to external domains
Get-MessageTrackingLog -EventId SEND -Start "03/20/2026" -End "03/28/2026" | Where-Object {$_.Recipients -like "*@gmail.com"}

# Find auto-forward (redirect) events
Get-MessageTrackingLog -EventId REDIRECT -ResultSize Unlimited

# Exchange Online: Message Trace
Get-MessageTrace -SenderAddress "user@company.com" -StartDate "03/20/2026" -EndDate "03/28/2026"

Parsing Tools & Analysis

Retention & Persistence

Version Differences

Anti-Forensics Resilience

MITRE ATT&CK Detection Mapping

Related Artifacts & Cross-References

References

1. Microsoft, “Message Tracking” — learn.microsoft.com
2. Microsoft, “Protocol Logging” — learn.microsoft.com
3. Microsoft, “Get-MessageTrace (Exchange Online)” — learn.microsoft.com
4. SANS Institute, “Exchange Forensics” — sans.org
5. CrowdStrike, “Exchange Incident Response” — crowdstrike.com