Hi all. I shall be testing in a virtual environment tomorrow but I thought I'd pose this question to the FF community.
I've been approached to offer an opinion on a case going back to Win95 days and I have never had the pleasure of working on Win95- I don't yet have the original image and therefore I'm not currently aware of the generation of Win95 I'm dealing with. Having discussed the case, it would appear that the 'silver bullet' will be related to the timing of one or two emails sent from/received by Outlook Express.
My question is; under Win95 would the time settings of the local host PC have affected the timestamps contained in email headers or were the time settings of the incoming/outgoing mail servers used at that time to timestamp emails within the email client?
Any recollections gratefully received.
Email headers have always been generated by the mail servers which originate, receive and/or relay the message. The mail application may add their own metadata but that information is not properly described as a "header".
Timestamps from proper internet mail servers generally specify the timezone/offset or are in UTC.
The mail application may add their own metadata but that information is not properly described as a "header".
Thank you Patrick - what you have described is also my understanding.
We were discussing the matter in the lab yesterday and one member of the team is insistent that he recalls something about local client timestamps being applied to mails under Win95. I wonder whether the application metadata that you describe may explain what he is recalling - he has an uncanny knack for being right very often! Does anyone recall Outlook Express behaving in such a manner upon Win95 and thus displaying locally-derived timestamps at an application level, notwithstanding the contents of the formal header?
I've learned that the email client was in fact Internet Mail, which was the forerunner to Outlook Express. It was packaged with IE3.
Testing has been difficult ? as I cannot get any of the modern day major webmail providers to work with such an old email client….
I worked a case several years ago that may be in line with what you are asking.
The suspect had backdated his system clock, and sent emails to a co-conspirator; he then printed the email and submitted it as his 'proof' that an email had been sent at that time (the time and date displayed on the sent/received email was the backdate)
The email header information (inserted by the email servers) maintained the actual date (the suspect had in fact changed his system clock back to the correct date and time rather quickly, and within 10 minutes had sent a followup email email saying something along the lines of "look what I found; that missing email")
All I had to do was display the headers for both emails, side by side, and discredit his story.
C.
PS I know the recipient was running Eudora; I do not recall what the suspect was running
NB I recall it was fairly easy to manipulate the locally stored e-mails in Outlook Express database. So I wouldn't trust any dates displayed there.