Email MD5 and Message Hash

[llanowar]

I notice that an email message has both an MD5 hash value and a message hash value. I understand, from the manual (14.1.17), the derivation of the Message Hash for email - but I am not sure why I am also seeing an MD5 hash value. I thought MD5 was only calculated for binary/loose files - how is MD5 calculated for email messages? Is the MD5 value for email messages just as valuable for email messages in determining uniqueness?

Thanks.

[AdamS]

I could be wrong but I understood the MD5 to be for the parent email and all its children as a contained file (think of a .msg) file which you export out of a PST. As part of the indexing process the children are all pulled out and the message component itself gets the message hash.

I'm sure I've over simplified and got a few things wrong, but in essence that's the way I've always thought of it.

 

[Alex]

Hello,

MD5 value of an email message can be defined as a hash of an exported EML file.

From the forensic point of view, this provides the most accurate identification of message duplicates, as it is computed for all MIME fields (unlike Message Hashes).

[llanowar]

Thank you kindly - Adam and Alex. Makes perfect sense now.