Thread-Index Header Field

Hello,

I’m examining a few emails and came across a header field named “Thread-Index” in some of them right above the “Date” header.

The field is populated similar to the example below:

Thread-Index: AdQc2DN7rLoS3hgnE/O76rpFzxN/EwAddF4A

Any idea what this represents? Could it contain information that can help us to find out if the emails are legitimate? Thanks in advance.

1 Like

This is a conversation index value (PR_CONVERSATION_INDEX MAPI property) in Base64 encoded form. I have some information on the format and a free tool to help decode it here: E-mail Conversation Index Analysis for Computer Forensics

Decoding this one results in the following output:

Conversation Index: AdQc2DN7rLoS3hgnE/O76rpFzxN/EwAddF4A
Header Timestamp: 07/16/2018 07:40:00.2799616 (UTC)
GUID: acba12de-1827-13f3-bbea-ba45cf137f13
Number of Children: 1

Child No: 1
Time Difference: 14:03:22.5476096
Mode: 0
Random No: 0
Sequence Count: 0
Calculated Timestamp: 07/16/2018 21:43:22.8275712 (UTC)

How Can This Help?

This might help in your investigation depending on what you are looking for. A few ideas:

1. Is the GUID Really Unique? The GUID part of the header block is designed to be unique. If you find the same GUID in multiple messages that seem completely disconnected (i.e., different participants, thread, etc.), then this might be a red flag.

2. Origination Date of First Message The header timestamp reflects the submission time of the initial message in the thread. You can compare this to PR_CLIENT_SUBMIT_TIME to corroborate the evidence. A major difference here can be a red flag.

3. Structure of The Thread As new messages are added to a thread (e.g., replies, forwards, etc.), the conversation index is expanded in 5-byte chunks. If the message you are looking at doesn’t match the thread structure reflected in the conversation index, this is a data point to consider. Keep in mind that the sender can change the quoted message body as they wish to alter the appearance of the message. So, some variations between the message structure and conversation index are to be expected.

4. Composition Time of Children In my testing, I’ve found that Outlook sets the time difference of child blocks based on when the child message is created rather than when it is actually submitted. In some cases, this might give you a clue as to how long the person took between creating the message (i.e., hitting reply, forward, etc.) and actually submitting the message (i.e., finishing composition and hitting “Send”).

I should add that I personally take conversation index evidence with a grain of salt and use it as a corroborating data point. This is mainly because the specification from Microsoft is not entirely clear, there are multiple, varying implementations some of which do not adhere to the specification, and there are many nuances due to local time being used and the effect of time inaccuracies on the devices that participate in an email thread. Still, a great tool to have in your toolbox when examining emails. :+1:t2:

2 Likes

Thank you! I have another thread index. I decoded the Base64 value and ended up with the hex representation below.

0101D449C3177E1347ABC447FA1327DB1C16FA410B21

This looks slightly different than the examples. Any tips on decoding it?

This one actually seems to be more in line with Microsoft’s official documentation.

01 One reserved byte
01D449C317 5-bytes for the header date in FILETIME format
7E1347ABC447FA1327DB1C16FA410B21 GUID

Here is what I get:

Header Timestamp: 09/11/2018 11:32:15.3913344 (UTC)
GUID: 7e1347ab-c447-fa13-27db-1c16fa410b21
Number of Children: 0