Hello,
I am an investigator and want to know if the pr_internet_message_id has some logic or meaning.
Is it just a unique hex-number for a new e-mail message, generated by Exchange server? Or can that number tell us something??
for example.
Can that number tell us something about:
- the date it was issued ?
- The kind / version of Exchange sever ?
- Is it in some way a subsequent number ?
- It must be a fake number (edited mapi item) because....?
- If someone faked an e-mailmesage in his sent items within Outlook, with a self composed pr_internet_message_id, and he sends that message a few months later to a friend, will the reply on that message by this friend, holds the same fake Message_id (thread information)?
- etc.
I hope someone can point me to the right information.
The questions in my case are related to Exchange Server 2010, but all information is welcome.
Regards,
Hans
(The Netherlanda)
