Forum Discussion

hanzelmans's avatar
hanzelmans
Copper Contributor
May 20, 2020

pr_internet_message_id - any logic or meaning ?

Hello, 
I am an investigator and want to know if the pr_internet_message_id has some logic or meaning.

Is it just a unique hex-number for a new e-mail message, generated by Exchange server? Or can that number tell us something??

 

for example.

Can that number tell us something about:

 

  • the date it was issued ?
  • The kind / version of Exchange sever ?
  • Is it in some way a subsequent number ?
  • It must be a fake number (edited mapi item) because....?
  • If someone faked an e-mailmesage in his sent items within Outlook, with a self composed pr_internet_message_id, and he sends that message a few months later to a friend, will the reply on that message by this friend, holds the same fake Message_id (thread information)?
  • etc.

 

I hope someone can point me to the right information.

The questions in my case are related to Exchange Server 2010, but all information is welcome.

 

Regards,

Hans 

(The Netherlanda)

 

No RepliesBe the first to reply

Resources