Greetings,
While examining the Windows registry during an ongoing investigation I noticed the subkey HKEY CURRENT USER > Software\Microsoft\Windows\CurrentVersion\UnreadMail\.
It contained a list of interesting mail-addresses, but I'm not quite sure on how \UnreadMail is populated and how it is used. Unfortunately neither a check of my beloved Carvey-books nor some Googling around turned up much information on this particular subject.
I found this for Windows XP though
http//
As I understand it some mail programs can be used to populate \UnreadMail which then presents a hyperlink on the logon screen with the number of unread mails. But in this particular case no such hyperlink is presented even though some of the MessageCount value data is greater than zero. Perhaps it is related to the target system running Windows Vista Home Basic?
If anyone could point me to further information on how the \UnreadMail subkey is populated and used I would appreciate it. It would be good to have some basics before going into experimentation.
Regards,
Jofre
Unfortunately neither a check of my beloved Carvey-books…
I'm not sure why they would…but thanks for checking.
…nor some Googling around turned up much information on this particular subject.
Interesting…I found quite a bit.
If anyone could point me to further information on how the \UnreadMail subkey is populated and used I would appreciate it. It would be good to have some basics before going into experimentation.
Very useful
http//
Gives some information about how the value is populated
http//
Talks about how to disable the message/hyperlink on the Welcome screen
http//
HTH
Oh, if it involves the Windows registry I always start by taking a look in the books, it keeps me in the right mindset at the very least. )
While Googling I mostly found information on how to remove the logon notification and how to use it in various applications, but not much real data on the mechanisms behind it. But I'll go back and have another look. I had definitely missed
A bit strange though that the latest time stamp I could find in it was several months before the computer was taken. Have to look into if the suspect changed mailprogram around then.
Anyway, thanks for your answer!
Best Regards,
/Jofre