llanowar Posted May 24, 2018 Report Share Posted May 24, 2018 I notice that an email message has both an MD5 hash value and a message hash value. I understand, from the manual (14.1.17), the derivation of the Message Hash for email - but I am not sure why I am also seeing an MD5 hash value. I thought MD5 was only calculated for binary/loose files - how is MD5 calculated for email messages? Is the MD5 value for email messages just as valuable for email messages in determining uniqueness? Thanks. Quote Link to comment Share on other sites More sharing options...
AdamS Posted May 25, 2018 Report Share Posted May 25, 2018 I could be wrong but I understood the MD5 to be for the parent email and all its children as a contained file (think of a .msg) file which you export out of a PST. As part of the indexing process the children are all pulled out and the message component itself gets the message hash. I'm sure I've over simplified and got a few things wrong, but in essence that's the way I've always thought of it. Quote Link to comment Share on other sites More sharing options...
Alex Posted May 25, 2018 Report Share Posted May 25, 2018 Hello, MD5 value of an email message can be defined as a hash of an exported EML file. From the forensic point of view, this provides the most accurate identification of message duplicates, as it is computed for all MIME fields (unlike Message Hashes). Quote Link to comment Share on other sites More sharing options...
llanowar Posted May 25, 2018 Author Report Share Posted May 25, 2018 Thank you kindly - Adam and Alex. Makes perfect sense now. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.