I am trying to find FileDate (creation, modified) in the header of an email that originated from M365. Any ideas?
I wouldn't expect any "file" date (created, modified) from anywhere inside the header of any email, whether or not it originated from M365. If we are talking about an .EML (email disk file) that has been somehow exfiltrated from an Outlook .PST file (for example), I expect there would be no such things. Typically you'll see Received timestamps in UTC by the various hops (nodes) in the delivery chain for the message. You will also see the actual Date: value of when the message was actually Sent (not composed). I'm sorry if that is not the answer you were looking for. If you can clarify your question, perhaps I might have a different reply for you.
