Message ID and hidden dates

Digital Forensics
1

Hi All-

I’m on an investigation and trying to identify if the following message-id “0877a7ba8b67721b6b521d55b5fbfa795f5d8d8e85941b6fdbd02fac943b411” has hidden dates. Does anyone know if this format has them? and, if so, how can I decode them?

Thanks for your help.

2

Do you have any more of these? This one may contain a timestamp here, but hard to tell with a single exemplar.

0877a7ba8b67721b6b521d55b5fbfa795f5d8d8e85941b6fdbd02fac943b411

01d55b5f:bfa795f5 ➫ 2019-08-25 16:11:27.2749557

3

Hi Arman-

I have this other one

5b3ea7ba3678a069d8b87aa6268da8d3c9e4149d42e909d3e0f9a4297930aecb@dominio.com

The previous one in its complete version:

0877a7ba8b67721b6b521d55b5fbfa795f5d8d8e85941b6fdbd02fac943b411c@dominio.com

Best regards,

4

Thanks for the additional example. It looks like the first string was missing the ‘c’ at the end.

Looking at the second ID, the timestamp I mentioned appears to be purely coincidental. The local part of the Message-IDs look like 32-byte hex strings—perhaps they are SHA-256 hashes. If so, I’m afraid I wouldn’t count on being able to find any timing information.

5

Thank you Arman for your help.

I am in another investigation and I have another message-id that possibly has the date and time hidden, maybe you can help me to solve it?

78cc17c6-9056-4a4a-969c-7d48046066c4

Regards

6

The appearance of that Message-ID is consistent with a GUID. v1 GUIDs contain timestamps with 100-nanosecond resolution (see RFC 4122).

For example:

8e64dd00-7331-11ed-a77e-0800200c9a66 ➫ December 3, 2022 5:40:19.792 PM (UTC)

However, your Message-ID appears to be a v4 GUID.

7

Thanks for your help Arman!

Best regards

1 Like
8

We have just added GUID timestamp decoding to FEI — FEI users will see this in our upcoming release :+1:t2: