Evolution Header Format
From Forensics Wiki
Revision as of 23:29, 22 July 2012 by Joachim Metz
Subject: header test From: Username <firstname.lastname@example.org> To: Username <email@example.com> Content-Type: text/plain Date: Sat, 28 Jul 2007 11:52:35 +0200 Message-Id: <1185616355.19231.0.camel@localhost> Mime-Version: 1.0 X-Mailer: Evolution 2.10.1 Content-Transfer-Encoding: 7bit
The Message id consists of five parts:
- The current time as returned by the time function followed by a period. The value is dislayed in decimal and is the number of seconds since midnight on 1 Jan 1970. In the example above, 1185616355 refers to Sat, 28 Jul 2007 09:52:35 GMT.
- The process id number in decimal followed by a period
- The third value starts at zero but may increase as more messages are sent. It is also followed by a period
- The word camel followed by an '@'
- If the canonical hostname can found, it is used. Otherwise the hostname
The Message id format comes from the function camel_header_msgid_generate in evolution-data-server/camel/camel-mime-utils.c.