Dates in Hiding Part 2—Gmail MIME Boundary Timestamps

This post on Gmail MIME boundary timestamps is an update to my previous Dates in Hiding post to cover some recent developments. Special thanks to @stigarve.hopland for his contributions!

The threadindex also seems to resolve to a timestamp:
Thread-Index: AdXEzIY/C5WB1x/BREeMK5BBoT9QGQ==

–>
$ echo “AdXEzIY/C5WB1x/BREeMK5BBoT9QGQ==” | base64 --decode | xxd
00000000: 01d5 c4cc 863f 0b95 81d7 1fc1 4447 8c2b …?..DG.+
00000010: 9041 a13f 5019 .A.?P.

= 01/06/2020 20:04:38 (UTC)

2 Likes

Very true! This is the conversation index used in Outlook/Exchange and often contains more than just a timestamp. I had put together a decoding tool for this as well :smiley: