ForensicsWiki will continue to operate as it has before and will not be shutting down. Thank you for your continued support of ForensicsWiki.

Outlook Express Header Format

From ForensicsWiki
Revision as of 02:39, 29 July 2007 by Fishor (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Version 6 of Outlook Express running on Microsoft Windows generates headers in the format:

Message-ID: <000f10c7183d$abe4d510$6031a8c0@hostname>
From: "Username" <username@sendinghost.com>
To: "Username" <username@receivinghost.com>
Subject: Testing
Date: Wed, 4 Apr 2007 14:11:45 +0100
MIME-Version: 1.0
Content-Type: text/plain;
	charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1807
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1807

Message ID Field

The Message-ID have 4 parts: [hex time]$[random?]$[hw-hash?]@[hostname]