I’m on an investigation and trying to identify if the following message-id “0877a7ba8b67721b6b521d55b5fbfa795f5d8d8e85941b6fdbd02fac943b411” has hidden dates. Does anyone know if this format has them? and, if so, how can I decode them?
Thanks for your help.
Do you have any more of these? This one may contain a timestamp here, but hard to tell with a single exemplar.
01d55b5f:bfa795f5 ➫ 2019-08-25 16:11:27.2749557
Thanks for the additional example. It looks like the first string was missing the ‘c’ at the end.
Looking at the second ID, the timestamp I mentioned appears to be purely coincidental. The local part of the Message-IDs look like 32-byte hex strings—perhaps they are SHA-256 hashes. If so, I’m afraid I wouldn’t count on being able to find any timing information.
Thank you Arman for your help.
I am in another investigation and I have another message-id that possibly has the date and time hidden, maybe you can help me to solve it?
The appearance of that Message-ID is consistent with a GUID. v1 GUIDs contain timestamps with 100-nanosecond resolution (see RFC 4122).
8e64dd00-7331-11ed-a77e-0800200c9a66 ➫ December 3, 2022 5:40:19.792 PM (UTC)
However, your Message-ID appears to be a v4 GUID.
Thanks for your help Arman!
We have just added GUID timestamp decoding to FEI — FEI users will see this in our upcoming release