Re: [PEN-TEST] examining exchange mail

["Deus, Attonbitus" <Thor () HAMMEROFGOD COM>]

> Not necessarily true.  Users can, of course, create personal folders to
> store messages in, and those are stored on the local drive.  Connecting to
> the Exchange server, even as admin, won't get you any closer to those
> messages.  A smart Exchange/Outlook user will set up a rule that
> immediately moves all their mail out of the default folder and into a
> local folder, to prevent cases of admin snooping just like this.

Then we just open their .pst from the admin shares, or, since we control the
server box in the first place, just capture all mail to and from their box
before it gets moved.  Local .pst files don't buy them anything.
AD