# MS Email Header: x-ms-exchange-organization-aadsender-creationtime

**URL:** <https://community.metaspike.com/t/ms-email-header-x-ms-exchange-organization-aadsender-creationtime/1972>\
**Category:** Digital Forensics\
**Created:** [May 10, 2024, 5:14am UTC](https://community.metaspike.com/t/ms-email-header-x-ms-exchange-organization-aadsender-creationtime/1972 "2024-05-10T05:14:09Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![fig007](https://community-cdn.metaspike.com/letter_avatar_proxy/v4/letter/f/41988e/32.png) [@fig007](https://community.metaspike.com/u/fig007)\
**Post date:** [May 10, 2024, 5:14am UTC](https://community.metaspike.com/t/ms-email-header-x-ms-exchange-organization-aadsender-creationtime/1972/1 "2024-05-10T05:14:09Z")

</div>

Hello,  
In a Microsoft email header, I find:

x-ms-exchange-organization-aadsender-creationtime: 637903162460000000

This looks like a filetime but converts to year 3622. I must be doing something wrong. Is there a re-ordering or some other step needed?

python code:  
import datetime

‘’’ Define the timestamp and epoch’‘’

timestamp = 637903162460000000

epoch = datetime.datetime(1601, 1, 1)

‘’‘Calculate the seconds since the epoch’‘’

seconds\_since\_epoch = timestamp / 10\*\*7

‘’’ Add seconds to epoch to get the actual time’‘’

actual\_time = epoch + datetime.timedelta(seconds=seconds\_since\_epoch)

print(“Datetime:”, actual\_time)

---

<div class="post-metadata">

**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\
**Post date:** [May 10, 2024, 3:43pm UTC](https://community.metaspike.com/t/ms-email-header-x-ms-exchange-organization-aadsender-creationtime/1972/2 "2024-05-10T15:43:15Z")

</div>

There is another Microsoft time unit that might be relevant here:

> **[DateTime.Ticks Property (System)](https://learn.microsoft.com/en-us/dotnet/api/system.datetime.ticks?view=net-8.0)**
>
> Gets the number of ticks that represent the date and time of this instance.

This would be the number of 100-nanosecond intervals that have elapsed since 12:00:00 AM, January 1, 0001 (as opposed to 1601 for FILETIME).

In your example, 637903162460000000 Ticks would represent 6/8/2022 8:17:26 PM—1,600 years earlier than your calculation.

I am not sure if `X-MS-Exchange-Organization-AADSender-CreationTime` represents a timestamp in Ticks, but it is a possibility.

---

<div class="post-metadata">

**Author:** ![fig007](https://community-cdn.metaspike.com/letter_avatar_proxy/v4/letter/f/41988e/32.png) [@fig007](https://community.metaspike.com/u/fig007)\
**Post date:** [May 10, 2024, 4:36pm UTC](https://community.metaspike.com/t/ms-email-header-x-ms-exchange-organization-aadsender-creationtime/1972/3 "2024-05-10T16:36:33Z")

</div>

> [@fig007](#):
>
> x-ms-exchange-organization-aadsender-creationtime: 637903162460000000

Thanks Arman! This date is much closer to the date on the email in plain text but it should be Nov. 8th not June 8th. Time is correct too. I’m guessing this `X-MS-Exchange-Organization-AADSender-CreationTime` field is not the email creation time. An email from Nov. 14th has almost the same value: 637903163330000000 (333 vs. 246) - a minute ahead.

Any other hidden field I can search for with email creation time? dkim is not present. There is a boundary field:

boundary=“_000\_BL3PR05MB91876F050DC78386F78CABA6993F9BL3PR05MB9187namp_”

---

<div class="post-metadata">

**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\
**Post date:** [May 10, 2024, 9:09pm UTC](https://community.metaspike.com/t/ms-email-header-x-ms-exchange-organization-aadsender-creationtime/1972/4 "2024-05-10T21:09:51Z")

</div>

> [@fig007](#):
>
> This date is much closer to the date on the email in plain text but it should be Nov. 8th not June 8th. Time is correct too. I’m guessing this `X-MS-Exchange-Organization-AADSender-CreationTime` field is not the email creation time.

I cannot point you to official documentation on that header. But, I believe the implication is that the header reflects the creation time of the Azure Active Directory object representing the sender of the message. So, I would expect the `X-MS-Exchange-Organization-AADSender-CreationTime` value to be earlier than the sent date of the email.

> [@fig007](#):
>
> Any other hidden field I can search for with email creation time?

If you have the message in a MAPI container, I would start by reviewing all available MAPI properties—especially the ones that are of a date/time type. Some other properties such as [Conversation Index](https://www.meridiandiscovery.com/how-to/e-mail-conversation-index-metadata-computer-forensics/) may be available in the headers and may provide information on the timing of the email. You may also find other hidden timestamps in the Content-IDs, etc.

---

<div class="post-metadata">

**Author:** ![fig007](https://community-cdn.metaspike.com/letter_avatar_proxy/v4/letter/f/41988e/32.png) [@fig007](https://community.metaspike.com/u/fig007)\
**Post date:** [May 11, 2024, 4:42am UTC](https://community.metaspike.com/t/ms-email-header-x-ms-exchange-organization-aadsender-creationtime/1972/5 "2024-05-11T04:42:14Z")

</div>

I don’t find the conversation index in my msg file. There is a thread-Index:

Thread-Index: AQHY760sLnptc6Vq6EuT1OpV3bqRc64uscNwgAaz4GA=

but the above format is not the same as the conversation index. This date is 2097?

---

<div class="post-metadata">

**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\
**Post date:** [May 13, 2024, 4:40pm UTC](https://community.metaspike.com/t/ms-email-header-x-ms-exchange-organization-aadsender-creationtime/1972/6 "2024-05-13T16:40:31Z")

</div>

Take a look here:

> [@Thread-Index Header Field](https://community.metaspike.com/t/thread-index-header-field/175):
>
> Hello, I’m examining a few emails and came across a header field named “Thread-Index” in some of them right above the “Date” header. The field is populated similar to the example below: Thread-Index: AdQc2DN7rLoS3hgnE/O76rpFzxN/EwAddF4A Any idea what this represents? Could it contain information that can help us to find out if the emails are legitimate? Thanks in advance.

---

<div class="post-metadata">

**Author:** ![fig007](https://community-cdn.metaspike.com/letter_avatar_proxy/v4/letter/f/41988e/32.png) [@fig007](https://community.metaspike.com/u/fig007)\
**Post date:** [May 13, 2024, 6:59pm UTC](https://community.metaspike.com/t/ms-email-header-x-ms-exchange-organization-aadsender-creationtime/1972/7 "2024-05-13T18:59:11Z")

</div>

> [@fig007](#):
>
> AQHY760sLnptc6Vq6EuT1OpV3bqRc64uscNwgAaz4GA=

Thanks Arman. The free tool is never emailed so I’m not sure if that works for this thread-id or not. I’ve tried to decode manually but get odd results where dates are either to early (1830’s) or to distant in the future.

For example this code below gives me 1830’s dates:

```auto
 import base64, struct, datetime

   def parse_thread_index(index):

    s = base64.b64decode(index)
    print(s)

    guid = struct.unpack('>IHHQ', s[6:22])
    guid = '{%08X-%04X-%04X-%04X-%12X}' % (guid[0], guid[1], guid[2], (guid[3] >> 48) & 0xFFFF, guid[3] & 0xFFFFFFFFFFFF)

    f = struct.unpack('>Q', s[:6] + b'\0\0')[0]
    ts = [datetime.datetime(1601, 1, 1) + datetime.timedelta(microseconds=f//10)]

    for n in range(22, len(s), 5):
        f = struct.unpack('>I', s[n:n+4])[0]
        ts.append(ts[-1] + datetime.timedelta(microseconds=(f<<18)//10))

    return guid, ts

```

with this output:

```auto

string decoded: b'\x01\x01\xd8\xef\xad,.zms\xa5j\xe8K\x93\xd4\xeaU\xdd\xba\x91s\xae.\xb1\xc3p\x80\x06\xb3\xe0`'
timestamps: [datetime.datetime(1830, 12, 28, 20, 14, 52, 876390), datetime.datetime(1833, 6, 2, 11, 45, 22, 506546), datetime.datetime(1835, 3, 16, 4, 27, 12, 890878)]
guid: {2E7A6D73-A56A-E84B-93D4-EA55DDBA9173}

```

---

<div class="post-metadata">

**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\
**Post date:** [May 13, 2024, 7:10pm UTC](https://community.metaspike.com/t/ms-email-header-x-ms-exchange-organization-aadsender-creationtime/1972/8 "2024-05-13T19:10:46Z")

</div>

I would move your start point one byte forward:

```auto
f = struct.unpack('>Q', s[1:7] + b'\0\0')[0]

```

---

<div class="post-metadata">

**Author:** ![fig007](https://community-cdn.metaspike.com/letter_avatar_proxy/v4/letter/f/41988e/32.png) [@fig007](https://community.metaspike.com/u/fig007)\
**Post date:** [May 13, 2024, 8:08pm UTC](https://community.metaspike.com/t/ms-email-header-x-ms-exchange-organization-aadsender-creationtime/1972/9 "2024-05-13T20:08:48Z")

</div>

That helped get the first email correct. I still have a timespan error as the second and third email times are off. They should be much closer to the first. New code below:

import base64, struct, datetime

def parse\_thread\_index(index):

```
s = base64.b64decode(index)
print("string decoded: ",s)

guid = struct.unpack('>IHHQ', s[6:22])
print("guid: ", guid)
guid = '{%08X-%04X-%04X-%04X-%12X}' % (guid[0], guid[1], guid[2], (guid[3] >> 48) & 0xFFFF, guid[3] & 0xFFFFFFFFFFFF)

f = struct.unpack('>Q', s[1:7] + b'\0\0')[0]
print("f: ", f)
print("f//10: ", f//10)
ts = [datetime.datetime(1601, 1, 1) + datetime.timedelta(microseconds=f//10)]

for n in range(23, len(s), 5):
    f = struct.unpack('>I', s[n:n+4])[0]
    print(" F:" , f)
    ts.append(ts[-1] + datetime.timedelta(microseconds=(f<<18) //10))

return guid, ts

```

returns:

string decoded: b’\x01\x01\xd8\xef\xad,.zms\xa5j\xe8K\x93\xd4\xeaU\xdd\xba\x91s\xae.\xb1\xc3p\x80\x06\xb3\xe0`’  
guid: (779775347, 42346, 59467, 10652396673151177075)  
f: 133119716057022464  
f//10: 13311971605702246  
F: 783401840  
F: 112451680  
timestamps: [datetime.datetime(2022, 11, 3, 17, 53, 25, 702246), datetime.datetime(2023, 6, 29, 10, 26, 54, 896742), datetime.datetime(2023, 8, 2, 13, 17, 48, 216934)]  
guid: {2E7A6D73-A56A-E84B-93D4-EA55DDBA9173}

---

<div class="post-metadata">

**Author:** ![fig007](https://community-cdn.metaspike.com/letter_avatar_proxy/v4/letter/f/41988e/32.png) [@fig007](https://community.metaspike.com/u/fig007)\
**Post date:** [May 15, 2024, 9:23pm UTC](https://community.metaspike.com/t/ms-email-header-x-ms-exchange-organization-aadsender-creationtime/1972/10 "2024-05-15T21:23:02Z")

</div>

> Blockquote  
> The free tool is never emailed so I’m not sure if that works for this thread-id or not.

I finally received the free tool but it doesn’t like the tread-index value below.

AQHY760sLnptc6Vq6EuT1OpV3bqRc64uscNwgAaz4GA=

returns: Please enter a valid Hex or Base64 conversation index value.

---

<div class="post-metadata">

**Author:** ![agungor](https://community-cdn.metaspike.com/user_avatar/community.metaspike.com/agungor/32/719_2.png) [@agungor](https://community.metaspike.com/u/agungor)\
**Post date:** [May 15, 2024, 9:44pm UTC](https://community.metaspike.com/t/ms-email-header-x-ms-exchange-organization-aadsender-creationtime/1972/11 "2024-05-15T21:44:59Z")

</div>

Makes sense—the free tool from Meridian is limited to the type of Conversation Index values described in that blog post.