Below is an example from within an eml file of an attachment header of an attached .msg email, the email it is attached to was sent 24 Jun 2018 :
creation-date=“Wed, 01 Jul 2020 20:19:53 GMT”;
modification-date=“Wed, 01 Jul 2020 20:19:53 GMT”
Date: Sat, 23 Jun 2018 11:43:02 +0000
Where is the creation-date derived from, is there a reason that this would be a later date than that of the email it was attached to, eg if the email had been saved outside of an email client on that date?
Creation date of headers of other attachments in the same email all appear to be the same creation-date as this but a second different to each other.
The modification-date of the other picture attachments, appear to be the date that the eml file was provided and different to the email attachment.
What I hope is the case is that the the created-date is the date the file was attached and shouldn’t change however the eml file that the header was taken from was created, be it downloaded directly from the server, or save by the email client?