Jump to content

Email MD5 and Message Hash


Recommended Posts

I notice that an email message has both an MD5 hash value and a message hash value. I understand, from the manual (14.1.17), the derivation of the Message Hash for email - but I am not sure why I am also seeing an MD5 hash value. I thought MD5 was only calculated for binary/loose files - how is MD5 calculated for email messages? Is the MD5 value for email messages just as valuable for email messages in determining uniqueness?


Link to comment
Share on other sites

I could be wrong but I understood the MD5 to be for the parent email and all its children as a contained file (think of a .msg) file which you export out of a PST. As part of the indexing process the children are all pulled out and the message component itself gets the message hash.

I'm sure I've over simplified and got a few things wrong, but in essence that's the way I've always thought of it.


Link to comment
Share on other sites


MD5 value of an email message can be defined as a hash of an exported EML file.

From the forensic point of view, this provides the most accurate identification of message duplicates, as it is computed for all MIME fields (unlike Message Hashes).

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Create New...