pr_internet_message_id - any logic or meaning ?

%3CLINGO-SUB%20id%3D%22lingo-sub-1405926%22%20slang%3D%22en-US%22%3Epr_internet_message_id%20-%20any%20logic%20or%20meaning%20%3F%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1405926%22%20slang%3D%22en-US%22%3E%3CP%3EHello%2C%26nbsp%3B%3CBR%20%2F%3EI%20am%20an%20investigator%20and%20want%20to%20know%20if%20the%26nbsp%3B%3CEM%3E%3CSTRONG%3Epr_internet_message_id%3C%2FSTRONG%3E%3C%2FEM%3E%20has%20some%20logic%20or%20meaning.%3CBR%20%2F%3E%3CBR%20%2F%3EIs%20it%20just%20a%20unique%20hex-number%20for%20a%20new%20e-mail%20message%2C%20generated%20by%20Exchange%20server%3F%20Or%20can%20that%20number%20tell%20us%20something%3F%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3Efor%20example.%3C%2FP%3E%3CP%3ECan%20that%20number%20tell%20us%20something%20about%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CUL%3E%3CLI%3Ethe%20date%20it%20was%20issued%20%3F%3C%2FLI%3E%3CLI%3EThe%20kind%20%2F%20version%20of%20Exchange%20sever%20%3F%3C%2FLI%3E%3CLI%3EIs%20it%20in%20some%20way%20a%26nbsp%3Bsubsequent%20number%20%3F%3C%2FLI%3E%3CLI%3EIt%20must%20be%20a%20fake%20number%20(edited%20mapi%20item)%20because....%3F%3C%2FLI%3E%3CLI%3EIf%20someone%20faked%20an%20e-mailmesage%20in%20his%20sent%20items%20within%20Outlook%2C%20with%20a%20self%20composed%26nbsp%3Bpr_internet_message_id%2C%20and%20he%20sends%20that%20message%20a%20few%20months%20later%20to%20a%20friend%2C%20will%20the%20reply%20on%20that%20message%20by%20this%20friend%2C%20holds%20the%20same%20fake%20Message_id%20(thread%20information)%3F%3C%2FLI%3E%3CLI%3Eetc.%3C%2FLI%3E%3C%2FUL%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20hope%20someone%20can%20point%20me%20to%20the%20right%20information.%3C%2FP%3E%3CP%3EThe%20questions%20in%20my%20case%20are%20related%20to%20Exchange%20Server%202010%2C%20but%20all%20information%20is%20welcome.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ERegards%2C%3C%2FP%3E%3CP%3EHans%26nbsp%3B%3C%2FP%3E%3CP%3E(The%20Netherlanda)%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-1405926%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3E2010%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EExchange%20Server%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EOutlook%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E
Occasional Visitor

Hello, 
I am an investigator and want to know if the pr_internet_message_id has some logic or meaning.

Is it just a unique hex-number for a new e-mail message, generated by Exchange server? Or can that number tell us something??

 

for example.

Can that number tell us something about:

 

  • the date it was issued ?
  • The kind / version of Exchange sever ?
  • Is it in some way a subsequent number ?
  • It must be a fake number (edited mapi item) because....?
  • If someone faked an e-mailmesage in his sent items within Outlook, with a self composed pr_internet_message_id, and he sends that message a few months later to a friend, will the reply on that message by this friend, holds the same fake Message_id (thread information)?
  • etc.

 

I hope someone can point me to the right information.

The questions in my case are related to Exchange Server 2010, but all information is welcome.

 

Regards,

Hans 

(The Netherlanda)

 

0 Replies