Notifications
Clear all

Email Date & Time

4 Posts
2 Users
0 Likes
226 Views
Nige
 Nige
(@nige)
Posts: 7
Active Member
Topic starter
 

I have a case were two printed emails from several years ago are of interest.

The content of both is identical save for the second one is timed exactly 24 hours after the first. I am advised the mails were generated on a bespoke (read unknown) web based system and that they could have been sent from any one of a number of clients within one office. Neither the server,client's or recipients machine exist today so nothing to examine and header information available. The clients and server are in the same time zone.

I am looking for explanations as to the 24 hour time difference.

Apart from the obvious, someone changed the clock on the client or the clock was slow, the web server was out of date, or someone spoofed the date can anyone offer other explanations please.

Thanks in anticipation

 
Posted : 27/05/2011 2:44 am
lucpel
(@lucpel)
Posts: 55
Trusted Member
 

If ip address and route are the same, i would check the time intervals between sender and receiver. eg

From Mr. Sender Wed May 25 195018 2011
X-Apparently-To receiver@yahoo.com via 209.191.69.180; Wed, 25 May 2011 125110 -0700

The time difference here is 1 second - 0.08. (considering the time zone difference 1251 + 7)
This time difference of an email sent after 24 hours would rarely be the same one. If both time differences match….(and Considering that you just have printed versions), i would rather think that one of the email headers was modified on purpose, and printed.

Just my opinion,,, cheers

 
Posted : 27/05/2011 3:45 am
Nige
 Nige
(@nige)
Posts: 7
Active Member
Topic starter
 

Thanks lucpel - I have just noticed a typo in my original post which should say No header information available.

 
Posted : 27/05/2011 4:05 am
lucpel
(@lucpel)
Posts: 55
Trusted Member
 

Yeah, was a typo misunderstood. Then, I would analyze particular characteristics of the printed version, like font type, font size, paper quality, or ink type. If these characteristics are not the same, at least you could dismiss some possibilities,

 
Posted : 29/05/2011 10:38 am
Share: