How does the email header field ‘thread-index’ work?

They are base64 encoded Conversation Index values. No need to reverse engineer them as they are documented by Microsoft on e.g. http://msdn.microsoft.com/en-us/library/ms528174(v=exchg.10).aspx and more detailed on http://msdn.microsoft.com/en-us/library/ee202481(v=exchg.80).aspx

Seemingly the indexes in your example doesn’t represent the same conversation, which probably means that the software that sent the mails wasn’t able to link them together.

EDIT: Unfortunately I don’t have enough reputation to add a comment, but adamo is right that it contains a timestamp – a somewhat esoteric encoded partial FILETIME. But it also contains a GUID, so it is pretty much guarenteed to be unique for that mail (of course the same mail can exist in multiple copies).

Leave a Comment