Can you please help, I was wondering if there is a time stamp in the below items and if so what format and how to convert, sent via outlook hotmail:
Content-type: multipart/mixed;
boundary="B_3662633087_2010628987"
boundary="B_3663268198_870938543"
boundary="B_3662634969_1542042878"
 When I have tried to convert the results dont make sense.Â
Check here:
https://www.metaspike.com/timestamps-forensic-email-examination/
https://www.metaspike.com/gmail-mime-boundary-delimiter-timestamps/
Though at first sight the ones you have don't look similar to the examples, if not to the Mac HFS format, which shouldn't be related/connected.
I guess you already tried Dcode:
https://www.digital-detective.net/dcode/
(AFAIK it has the most complete collection of date formats, but yours could well be not in the tool).
jaclaz
Â
Â
Â
Thank you, I had read and tried the tool mentioned, if I take section after _ unix epoch time seems to be the best match but, it spits out some dates which are in the future.
I would try the first part, before the _, attempting to decode it as MAC HFS, that seems the most similar, and actually comes out with seemingly non-absurd dates/times, but really no idea how/why/by what that encoding would be used.
https://www.epochconverter.com/mac
An HFS Plus-timestamp is the number of seconds since midnight, January 1, 1904, GMT.
These timestamps are also used by Apple iPod's, Palm OS, JMP/JSL datetime and others.
Â
Converting timestamp 3662633087:
GMT: Thursday, January 23, 2020 2:04:47 PM
Â
Â
Converting timestamp 3663268198:
GMT: Thursday, January 30, 2020 10:29:58 PM
Â
Converting timestamp 3662634969:
GMT: Thursday, January 23, 2020 2:36:09 PM
Only you can say if these dates/times make sense in your context.
jaclaz