X-MimeOLE domain

Digital Forensics
1

I obversed that certain email in different dbx/pst backups had different X-MimeOLE domains.
e.g.

X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.5512

and

X-Mailer: Microsoft Outlook Express 6.00.2900.3138
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.3350

Was this domain appended when creating a backup mailbox file?

2

I would expect the X-MimeOLE header on outbound messages from Outlook Express, Windows Mail, and some versions of Outlook. I do not believe it would be inserted during backup.

I recently sent a test message using Outlook Express 6.00.2900.2180 and observed the following headers on the recipient’s side:

X-Mailer: Microsoft Outlook Express 6.00.2900.2180
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

Here is an example I found online for Outlook:

X-Mailer: Microsoft Office Outlook 11
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2900.2180

For reference, here is some documentation on MimeOLE-related messaging functions from the Windows Mail (formerly Outlook Express) Messaging Reference: