Daily Blog #414: Exploring Extended MAPI Part 18

Exploring Extended MAPI Part 18 by David Cowen - Hacking Exposed Computer Forensics Blog



Hello Reader,
         I'm in the BKK airport heading to Phuket today in my continued adventures. Got here nice and early so now I'm at the gate writing a blog post! After my last post I'm very curious now about what other actions I take in OWA will effect my already downloaded Outlook mail. So to get a base line I'm doing something that I think will for sure modify the message on both sides, I'm reply to the message.

In my initial testing, replying to a message in OWA for a message I sent through Outlook connected to the same account, I brought up the original message and inspected the Extended MAPI to find there was No Change!

Meaning that the message wasn't marked a replied to and within outlook it didn't recognize the conversation thread within the message. Something very interesting is happening.

I'm going to attempt to restart Outlook and see if I can get it resync everything but this certainly changes how I'm going to have to approach these investigations. I need to start pulling the data from exchange directly to see if doing that will update the metadata.


This is a 19-part series on Exploring Extended MAPI. You can find the rest of the posts here

Post a Comment