2003 Exchange ActiveSync's FE - BE interaction or how determine message from -FlatUrlSpace- URL

2013-01-29

Sometimes we need to determine what object exactly requested by client. This time I will show, how it can be done for activesync devices with Exchange 2003.

If we look in IIS logs on FrontEnd server, activesync's device request seems like this:
POST /Microsoft-Server-ActiveSync User=test-user&DeviceId=ApplDMPHTC56DVGJ&DeviceType=iPad&Cmd=Ping&Log=V4TNASNC:0A0C0D0FS:0A0C0D0SP:1C19I8487S49266R0S0L900H0P

On BackEnd server it will looks like:
/exchange/test-user@contoso.com/-FlatUrlSpace-/b284ef6a3c5c3c4b81caadcce6c72ec4-17A0/3b4222a57de41147b2e8cb424c0d9025-502eb

How we can interpreter it? Some description can be found at https://msdn.microsoft.com/en-us/library/ee237541(v=exchg.80).aspx

For folders: https://server/virtual_root/-FlatUrlSpace-/something-not-important-in-this-case-fid
For messages:

There must be hyphen (-) between the GUID and the ID.

In other words we need find in folder with FID 17A0, message with MID 502eb.

How determine folder name by FID:

Use PFDAVAdmin (https://www.microsoft.com/en-us/download/details.aspx?id=22427) to open required mailbox:

After you connected to mailbox:

Choose Tools -> Export Properties

In PropertyExportForm we need to select:

ptagFID: 0x67480014

and check, that PR_DISPLAY_NAME: 0x3001001E selected

All other property's checkboxes can be cleaned:

After folder's properties successfully exported

We can check output file:

Folder Path PR_DISPLAY_NAME : 0x3001001E ptagFID : 0x67480014
https://exchange-2003-2/exchange/test\@dmkhre-2003.com https://exchange-2003-2/exchange/test\@dmkhre-2003.com
https://exchange-2003-2/exchange/test\@dmkhre-2003.com\Входящие Входящие 2-1AC4
https://exchange-2003-2/exchange/test\@dmkhre-2003.com\Исходящие Исходящие 2-1AC5
https://exchange-2003-2/exchange/test\@dmkhre-2003.com\Отправленные Отправленные 2-1AC6
https://exchange-2003-2/exchange/test\@dmkhre-2003.com\Удаленные Удаленные 2-1AC7
https://exchange-2003-2/exchange/test\@dmkhre-2003.com\Дневник Дневник 2-17A3
https://exchange-2003-2/exchange/test\@dmkhre-2003.com\Задачи Задачи 2-17A5
https://exchange-2003-2/exchange/test\@dmkhre-2003.com\Заметки Заметки 2-17A4
https://exchange-2003-2/exchange/test\@dmkhre-2003.com\Календарь Календарь 2-17A0
https://exchange-2003-2/exchange/test\@dmkhre-2003.com\Контакты Контакты 2-17A1
https://exchange-2003-2/exchange/test\@dmkhre-2003.com\Нежелательная почта Нежелательная почта 2-17A6
https://exchange-2003-2/exchange/test\@dmkhre-2003.com\Черновики Черновики 2-17A2
https://exchange-2003-2/exchange/test\@dmkhre-2003.com\Sync Issues Sync Issues 1-3ABD
https://exchange-2003-2/exchange/test\@dmkhre-2003.com\Sync Issues\Conflicts Conflicts 1-3ABE
https://exchange-2003-2/exchange/test\@dmkhre-2003.com\Sync Issues\Local Failures Local Failures 1-3ABF
https://exchange-2003-2/exchange/test\@dmkhre-2003.com\Sync Issues\Server Failures Server Failures 1-3AC0

As a result Calendar folder has FID 2-17A0 (Календарь 2-17A0)

Now we determined Folder name by FID.

How determine message by MID:

Use MrMAPI (https://mfcmapi.codeplex.com/) to export message MIDs:

As we know, that it is calendar folder we can use for default profile:

mrmapi.exe -folder 1 -mid >calendar-mids.txt

For other profile:

mrmapi.exe -folder 1 -mid -profile Outlook > calendar-mids.txt

of cause we can dump all messages MID's in mailbox by:

mrmapi.exe -mid >calendar-mids.txt

As a result you will get something like:

9-502eb R MeetingN

9-502ec R MeetingN+1

9-502ed R MeetingN+1

So our target - MeetingN

Now we know Folder and Message.

P.S.

You can also use MrMAPI to export FIDs: mrmapi -FID