In today’s fast-paced market, availability of an individual is increasingly important. Thus presents the need to be able to schedule an appointment/meeting with a person even if they are not available. Exchange provides such a service by storing...

EMF File Overview Generally, most people are familiar with two types of graphics files: bitmap and vector. Bitmapped graphics present a 1-to-1 pixel representation of an image. This is also known as raster graphics. These types of files cannot...

Hi y’all, Sebastian from Texas here! I’ve been at the File Sharing Plugfest last week. This time around I’ve had the chance to give a presentation on how we use the different sets of tools that we have at hand (both internal and...

I am writing this blog in response to a need I felt when I was new to authentication in Windows. The blog does not intend to reinvent the wheel, instead to help someone new to Windows authentication to get started and find the resources one needs to understand...

Incremental Change Synchronization ICS provides a means for the client to replicate changes in a folder or hierarchy between two different points in time. This protocol is actively used by Outlook to synchronize changes between the Exchange server...

In Part 2, I concluded my dissection of the rights managed email message example, with locating the DRMTransform\Primary stream. At the time, I didn’t go into much detail because I was focused on a) finding the message.rpmsg attachment and b) showing...

Exploring the CFB File Format 9 File Security Due to the nature of a compound file, a single file in a file-system, the operating system security mechanisms is ultimately what controls the security regarding the file in question. Using the ACL, you...

Exchange ActiveSync Provisioning EAS Provisioning is a means to download and apply devices on an activesync device. The provisioning process on a client will generally occur when the server requests that the provisioning is necessary. If a client...

Exploring the CFB File Format 8 Range Lock Sectors A range lock sector is a part of a CFB file that is used for concurrency and transactions. The range sector will only appear in files greater than 2 GB. As we have seen in previous posts, there...

Exploring the CFB File Format 7 ------------------------------- [- Red-Black Trees -] As we have seen, OLE Structured Storage files are a series of storages and streams like a modern day FAT filesystem. One design goal of a filesystem in this...

If you were not already familiar with decoding Exchange Server to Client communication, or have done so manually in the past, I present to you The Microsoft Exchange RPC Extractor (RPX). RPX is a command-line driven tool that parses network captures and...