Message ID and hidden dates

Hi All-

I’m on an investigation and trying to identify if the following message-id “0877a7ba8b67721b6b521d55b5fbfa795f5d8d8e85941b6fdbd02fac943b411” has hidden dates. Does anyone know if this format has them? and, if so, how can I decode them?

Thanks for your help.

Do you have any more of these? This one may contain a timestamp here, but hard to tell with a single exemplar.


01d55b5f:bfa795f5 ➫ 2019-08-25 16:11:27.2749557

Hi Arman-

I have this other one

The previous one in its complete version:

Best regards,

Thanks for the additional example. It looks like the first string was missing the ‘c’ at the end.

Looking at the second ID, the timestamp I mentioned appears to be purely coincidental. The local part of the Message-IDs look like 32-byte hex strings—perhaps they are SHA-256 hashes. If so, I’m afraid I wouldn’t count on being able to find any timing information.

Thank you Arman for your help.

I am in another investigation and I have another message-id that possibly has the date and time hidden, maybe you can help me to solve it?



The appearance of that Message-ID is consistent with a GUID. v1 GUIDs contain timestamps with 100-nanosecond resolution (see RFC 4122).

For example:

8e64dd00-7331-11ed-a77e-0800200c9a66 ➫ December 3, 2022 5:40:19.792 PM (UTC)

However, your Message-ID appears to be a v4 GUID.

Thanks for your help Arman!

Best regards

1 Like

We have just added GUID timestamp decoding to FEI — FEI users will see this in our upcoming release :+1:t2: