[Outlook] The secret of the profile in registry.

yt-summer

　　As a IT supporter, from time to time, need to obtain some informations from user's outlook profile, like PST path.
　　We can use com object for outlook, make script to do that, but, this needs knowledge on outlook.application com object, and another hand, invoke com object is a little bit slow.
　　Most important is, com object can only run when user logged, cause outlook profiles are stored in HKEY_CURRENT_USER key, other users can't load on behalf of particlar user, as a result, can't use com object to load profile.
　　This kind of request can be accomplished by analysis profile registries. Do some loop and recursion, much faster.
　　Below is the profile location in registry,



HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles
　　Surely, totally unfriendly, see below,

　　You many find, they all are Hex strings, from 0 to 9, and a to f, actually those Hex strings are used by MAPI, but for us, really unfriendly.
　　Anyway, some values/data from those keys, must including the PST information we needed, what we need to do is analysis them.
　　After some research, in those hex strings, some are randomly generated, some are fixed, below listed should be commonly everywhere, i also add my own comments for the purpose, must apologize, i didn't read much contents in MSDN, so i just try on myself, and make the conclusion.



f86ed2903a4a11cfb57e524153480001    After removed, outlook still works, and not generated automatically.
9207f3e0a3b11019908b08002b2a56c2    providers
9375CFF0413111d3B88A00104B2A6676    Signature
8503020000000000c000000000000046    Do not remove, need the value 0102300b, otherwise, outlook won't startup.
5acf76a3665511cea39a00aa004acafa    After removed, outlook still works, and not generated automatically.
3517490d76624c419a828607e2a54604    After removed, outlook still works, and generated automatically.
13dbb0c8aa05101a9bb000aa002fc45a    Seems related to outlook anywhere.
0a0d020000000000c000000000000046    outlook most recently used data.
{D9734F19-8CFB-411D-BC59-833E334FCB5E}    After removed, outlook still works, and generated automatically.
　　The PST file path information, is stored in the value stores "providers", see below, all PST and mailbox, store in the value "01023d00".

　　We can see they all are hex single bytes,
　　1. every 2 lines, can combine to 1 or more array, which means, total number of bytes, must be multipled by 16.
　　2. The string combined in step 1, is a subkey under profile.
　　3. Every string, is a provider, we can see it on outlook, which is our mounted PST and mailboxes.
　　Grey out some key information of my company,

　　I mentioned 3 points above, below one single picture can present what i said.

　　Quite easy, right?
　　Let's open the key "F67F21B*****", see what's the contents. There is a value named "001f3001", its data says it's a PST provider, so where is the PST file location? The answer is "001f6700".

　　The data in the provider value, contains many mailboxes or PST files, and also public folder which we normally can't see, we can read them all depends on the way i mentioned above.
　　And now has some questions, what's the meaning of other values? how know the value 01023d00 stores providers? what's the purpose of other keys?
　　Regarding to those questions, i must say i am not able to answer all, let me paste a URL from MSDN.
　　http://msdn.microsoft.com/en-us/library/bb415650.aspx
　　And there is another web link found online, out-of-date, and it's german, but still referable,
　　http://www.msxfaq.de/clients/mapireg.htm
　　And, more bad news, i didn't write any PST capture script, because i am in the question because there is a person in BBS encountered this, i actually didn't have any requirement, truns out, no script wrote from my side.