# Message ID and hidden dates **URL:** \ **Category:** Digital Forensics\ **Created:** [July 4, 2022, 6:44pm UTC](https://community.metaspike.com/t/message-id-and-hidden-dates/1009 "2022-07-04T18:44:21Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![CAForense](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/caforense/32/315_2.png) [@CAForense](https://community.metaspike.com/u/CAForense)\ **Post date:** [July 4, 2022, 6:44pm UTC](https://community.metaspike.com/t/message-id-and-hidden-dates/1009/1 "2022-07-04T18:44:21Z")
Hi All- I’m on an investigation and trying to identify if the following message-id “0877a7ba8b67721b6b521d55b5fbfa795f5d8d8e85941b6fdbd02fac943b411” has hidden dates. Does anyone know if this format has them? and, if so, how can I decode them? Thanks for your help. ---
**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\ **Post date:** [July 7, 2022, 3:09pm UTC](https://community.metaspike.com/t/message-id-and-hidden-dates/1009/2 "2022-07-07T15:09:17Z")
Do you have any more of these? This one may contain a timestamp here, but hard to tell with a single exemplar. 0877a7ba8b67721b6b521d55b5fbfa795f5d8d8e85941b6fdbd02fac943b411 01d55b5f:bfa795f5 ➫ 2019-08-25 16:11:27.2749557 ---
**Author:** ![CAForense](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/caforense/32/315_2.png) [@CAForense](https://community.metaspike.com/u/CAForense)\ **Post date:** [July 7, 2022, 4:51pm UTC](https://community.metaspike.com/t/message-id-and-hidden-dates/1009/3 "2022-07-07T16:51:18Z")
Hi Arman- I have this other one [5b3ea7ba3678a069d8b87aa6268da8d3c9e4149d42e909d3e0f9a4297930aecb@dominio.com](mailto:5b3ea7ba3678a069d8b87aa6268da8d3c9e4149d42e909d3e0f9a4297930aecb@dominio.com) The previous one in its complete version: [0877a7ba8b67721b6b521d55b5fbfa795f5d8d8e85941b6fdbd02fac943b411c@dominio.com](mailto:0877a7ba8b67721b6b521d55b5fbfa795f5d8d8e85941b6fdbd02fac943b411c@dominio.com) Best regards, ---
**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\ **Post date:** [July 7, 2022, 9:28pm UTC](https://community.metaspike.com/t/message-id-and-hidden-dates/1009/4 "2022-07-07T21:28:33Z")
Thanks for the additional example. It looks like the first string was missing the ‘c’ at the end. Looking at the second ID, the timestamp I mentioned appears to be purely coincidental. The local part of the Message-IDs look like 32-byte hex strings—perhaps they are SHA-256 hashes. If so, I’m afraid I wouldn’t count on being able to find any timing information. ---
**Author:** ![CAForense](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/caforense/32/315_2.png) [@CAForense](https://community.metaspike.com/u/CAForense)\ **Post date:** [December 3, 2022, 2:39pm UTC](https://community.metaspike.com/t/message-id-and-hidden-dates/1009/5 "2022-12-03T14:39:04Z")
Thank you Arman for your help. I am in another investigation and I have another message-id that possibly has the date and time hidden, maybe you can help me to solve it? 78cc17c6-9056-4a4a-969c-7d48046066c4 Regards ---
**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\ **Post date:** [December 3, 2022, 5:45pm UTC](https://community.metaspike.com/t/message-id-and-hidden-dates/1009/6 "2022-12-03T17:45:32Z")
The appearance of that Message-ID is consistent with a GUID. v1 GUIDs contain timestamps with 100-nanosecond resolution (_see_ [RFC 4122](https://datatracker.ietf.org/doc/html/rfc4122#section-4.1.4)). For example: 8e64dd00-7331-11ed-a77e-0800200c9a66 ➫ December 3, 2022 5:40:19.792 PM (UTC) However, your Message-ID appears to be a v4 GUID. ---
**Author:** ![CAForense](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/caforense/32/315_2.png) [@CAForense](https://community.metaspike.com/u/CAForense)\ **Post date:** [December 4, 2022, 4:11pm UTC](https://community.metaspike.com/t/message-id-and-hidden-dates/1009/7 "2022-12-04T16:11:04Z")
Thanks for your help Arman! Best regards ---
**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\ **Post date:** [December 5, 2022, 6:34pm UTC](https://community.metaspike.com/t/message-id-and-hidden-dates/1009/8 "2022-12-05T18:34:32Z")
We have just added GUID timestamp decoding to FEI — FEI users will see this in our upcoming release 👍🏻 [![](https://img.youtube.com/vi/8KhI7Jt-sq4/maxresdefault.jpg "Decoding GUID Timestamps in FEI") ](https://www.youtube.com/watch?v=8KhI7Jt-sq4)