# Dates in Hiding—Uncovering Timestamps in Forensic Email Examination

**URL:** <https://community.metaspike.com/t/dates-in-hiding-uncovering-timestamps-in-forensic-email-examination/19>\
**Category:** Digital Forensics\
**Created:** [September 17, 2019, 7:00am UTC](https://community.metaspike.com/t/dates-in-hiding-uncovering-timestamps-in-forensic-email-examination/19 "2019-09-17T07:00:00Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\
**Post date:** [September 17, 2019, 7:00am UTC](https://community.metaspike.com/t/dates-in-hiding-uncovering-timestamps-in-forensic-email-examination/19/1 "2019-09-17T07:00:00Z")

</div>

> **[Dates in Hiding—Uncovering Timestamps in Forensic Email Examination](https://www.metaspike.com/timestamps-forensic-email-examination/)**
>
> During the forensic examination of emails, timestamps hidden in various data points such as unique identifiers can provide valuable timing information.

---

<div class="post-metadata">

**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\
**Post date:** [January 14, 2020, 8:37pm UTC](https://community.metaspike.com/t/dates-in-hiding-uncovering-timestamps-in-forensic-email-examination/19/2 "2020-01-14T20:37:02Z")

</div>

I feel that this Twitter thread by [@mattnotmax](https://twitter.com/mattnotmax) is a good summary with some fun tidbits!

> **[Thread by @mattnotmax: So in #DFIR you'll come across lots (and lots) of...](https://threadreaderapp.com/thread/1213774556399198208.html)**
>
> Thread by @mattnotmax: So in #DFIR you'll come across lots (and lots) of timestamps. Let's take a quick dive into this weird and wonderful wo/x) For Windows, FILETIME is your main man. It's a 64-bit value that represents the number of 100-nanosecond...