# Dates in Hiding Part 2—Gmail MIME Boundary Timestamps

**URL:** <https://community.metaspike.com/t/dates-in-hiding-part-2-gmail-mime-boundary-timestamps/288>\
**Category:** Digital Forensics\
**Tags:** email-forensics, blog-posts\
**Created:** [March 24, 2020, 6:46pm UTC](https://community.metaspike.com/t/dates-in-hiding-part-2-gmail-mime-boundary-timestamps/288 "2020-03-24T18:46:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\
**Post date:** [March 24, 2020, 6:46pm UTC](https://community.metaspike.com/t/dates-in-hiding-part-2-gmail-mime-boundary-timestamps/288/1 "2020-03-24T18:46:03Z")

</div>

This post on Gmail MIME boundary timestamps is an update to my previous [Dates in Hiding](https://community.metaspike.com/t/dates-in-hiding-uncovering-timestamps-in-forensic-email-examination/19) post to cover some recent developments. Special thanks to @stigarve.hopland for his contributions!

> **[Dates in Hiding Part 2 — Gmail MIME Boundary Timestamps](https://www.metaspike.com/gmail-mime-boundary-delimiter-timestamps/)**
>
> MIME boundary delimiters in messages sent via Gmail contain hidden timestamps that can be used by digital forensic examiners when investigating email fraud.

---

<div class="post-metadata">

**Author:** ![justsomeguy](https://community-cdn.metaspike.com/letter_avatar_proxy/v4/letter/j/e9c0ed/32.png) [@justsomeguy](https://community.metaspike.com/u/justsomeguy)\
**Post date:** [March 30, 2020, 6:31am UTC](https://community.metaspike.com/t/dates-in-hiding-part-2-gmail-mime-boundary-timestamps/288/2 "2020-03-30T06:31:04Z")

</div>

The threadindex also seems to resolve to a timestamp:  
Thread-Index: AdXEzIY/C5WB1x/BREeMK5BBoT9QGQ==

–\>  
$ echo “AdXEzIY/C5WB1x/BREeMK5BBoT9QGQ==” | base64 --decode | xxd  
00000000: 01d5 c4cc 863f 0b95 81d7 1fc1 4447 8c2b …?..DG.+  
00000010: 9041 a13f 5019 .A.?P.

= 01/06/2020 20:04:38 (UTC)

---

<div class="post-metadata">

**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\
**Post date:** [March 30, 2020, 3:34pm UTC](https://community.metaspike.com/t/dates-in-hiding-part-2-gmail-mime-boundary-timestamps/288/3 "2020-03-30T15:34:45Z")

</div>

Very true! This is the conversation index used in Outlook/Exchange and often contains more than just a timestamp. I had put together a decoding tool for this as well 😃

> **[E-mail Conversation Index Analysis for Computer Forensics](https://www.meridiandiscovery.com/how-to/e-mail-conversation-index-metadata-computer-forensics/)**
>
> Conversation index is a key MAPI property that is frequently extracted by computer forensics and e-Discovery software, but yet usually underutilized.