I recently had someone ask me about call forwarding and simultaneous ring configuration within Skype for Business server. Specifically, they were trying to understand where the data is actually stored within the environment. I did some quick googling through which I found references to SefaUtil and a couple people who have written some fantastic GUI wrappers for it, but not much in terms of where the data is actually stored. I did manage to find one script that pulled the information from data extracted via the Export-CsUserData cmdlet, which ultimately pointed me in the right direction.
So the short answer is that the data is stored in the RTCLOCAL SQL Express instance on the user's primary home server in the "PublishedStaticInstance" table. To get the information I wrote a script that takes the user's SIP Address, looks up their primary home server, and then connects to the SQL Express instance to query for the data. Using the SIP Address you have to first query the "Resource" table to find the user's ResourceId as that is what the information is stored under in the "PublishedStaticInstance" table. There is actually quite a bit of information in the "PublishedStaticInstance" table including details for blocked users amongst other things. But what we're looking for is stored with a "CategoryId" of 8 which is routing information.
Parsing through the information returned you can see if the user has call forwarding and/or simultaneous ringing configured and if so what the destination SIP Address(es) or telephone numbers are. The "Client Flag" setting shows if the user has configured call forward or simultaneous ring, and the destinations will show below that. I've also included a -ShowXml parameter in the script that will display the full routing configuration just as it's stored in SQL for reference.
As with everything I post, this script is for informational purposes only with no warranty or guarantee expressed, implied, or suggested. Feel free to let me know if you have any questions or comments.