Email Timestamp con...
 
Notifications
Clear all

Email Timestamp conversion

bilbofids
(@bilbofids)
New Member

Can you please help, I was wondering if there is a time stamp in the below items and if so what format and how to convert, sent via outlook hotmail:

Content-type: multipart/mixed;

boundary="B_3662633087_2010628987"
boundary="B_3663268198_870938543"

boundary="B_3662634969_1542042878"

 When I have tried to convert the results dont make sense. 

Quote
Topic starter Posted : 10/11/2020 3:49 pm
jaclaz
(@jaclaz)
Community Legend

Check here:

https://www.metaspike.com/timestamps-forensic-email-examination/

https://www.metaspike.com/gmail-mime-boundary-delimiter-timestamps/

Though at first sight the ones you have don't look similar to the examples, if not to the Mac HFS format, which shouldn't be related/connected.

I guess you already tried Dcode:

https://www.digital-detective.net/dcode/

(AFAIK it has the most complete collection of date formats, but yours could well be not in the tool).

jaclaz

 

 

ReplyQuote
Posted : 11/11/2020 8:14 am
bilbofids
(@bilbofids)
New Member

@jaclaz

 

Thank you, I had read and tried the tool mentioned, if I take section after _ unix epoch time seems to be the best match but, it spits out some dates which are in the future.

ReplyQuote
Topic starter Posted : 11/11/2020 10:09 am
jaclaz
(@jaclaz)
Community Legend

I would try the first part, before the _, attempting to decode it as MAC HFS, that seems the most similar, and actually comes out with seemingly non-absurd dates/times, but really no idea how/why/by what that encoding would be used.

https://www.epochconverter.com/mac

An HFS Plus-timestamp is the number of seconds since midnight, January 1, 1904, GMT.

These timestamps are also used by Apple iPod's, Palm OS, JMP/JSL datetime and others.

 

Converting timestamp 3662633087:
GMT: Thursday, January 23, 2020 2:04:47 PM

 

 

Converting timestamp 3663268198:
GMT: Thursday, January 30, 2020 10:29:58 PM

 

Converting timestamp 3662634969:
GMT: Thursday, January 23, 2020 2:36:09 PM

Only you can say if these dates/times make sense in your context.

jaclaz

ReplyQuote
Posted : 11/11/2020 6:50 pm
Share: