This post on Gmail MIME boundary timestamps is an update to my previous Dates in Hiding post to cover some recent developments. Special thanks to @stigarve.hopland for his contributions!
The threadindex also seems to resolve to a timestamp:
Thread-Index: AdXEzIY/C5WB1x/BREeMK5BBoT9QGQ==
–>
$ echo “AdXEzIY/C5WB1x/BREeMK5BBoT9QGQ==” | base64 --decode | xxd
00000000: 01d5 c4cc 863f 0b95 81d7 1fc1 4447 8c2b …?..DG.+
00000010: 9041 a13f 5019 .A.?P.
= 01/06/2020 20:04:38 (UTC)
2 Likes
Very true! This is the conversation index used in Outlook/Exchange and often contains more than just a timestamp. I had put together a decoding tool for this as well 