Hello, I am an investigator and want to know if the pr_internet_message_id has some logic or meaning.
Is it just a unique hex-number for a new e-mail message, generated by Exchange server? Or can that number tell us something??
Can that number tell us something about:
the date it was issued ?
The kind / version of Exchange sever ?
Is it in some way a subsequent number ?
It must be a fake number (edited mapi item) because....?
If someone faked an e-mailmesage in his sent items within Outlook, with a self composed pr_internet_message_id, and he sends that message a few months later to a friend, will the reply on that message by this friend, holds the same fake Message_id (thread information)?
I hope someone can point me to the right information.
The questions in my case are related to Exchange Server 2010, but all information is welcome.