Guys. I’m trying to determine which corporate mail accounts are forwarding every mail recieved to another address. There is a setting in Outlook to enable this but I can’t find a way to measure it. there must be a setting in the registry I can exploit. Any thoughts on how to achieve this?
You might run some tests with regmon and see if you can tell if the info is updated in the registry and if it is, we can probably help you extract it…
It is possible that this information is stored in the .pst or .ost files, which are huge files in a proprietary format that would make them very hard to inspect…