Finding the time a message was send from the return receipt
Daniel Nashed 17 July 2019 05:16:16
We had an interesting and sort of funny support call this week.
An user got a reply from a service database to confirm his request sent in by mail.
The original message sent was a return receipt. But the sender said that there wasn't any received message, with that subject which could have generated a return receipt.
We checked all the logs for an outgoing previous message, without any luck.
Than I had the idea to check the $REF field of the return receipt to find out the time the original message was send.
The $REF is the UNID of the original document (response doc). The last part of the UNID is the Note part which is actually a TIMEDATE.
F409DB34F:1C3EEDFB-NC1257ACC:004FDD93
The internal representation of a TIMEDATE looks like this:
typedef struct tagTIMEDATE {
DWORD Innards[2];
} TIMEDATE;
You can take the internal binary representation of a TIMEDATE and convert it back to a human readable format.
So I wrote a small C-API routine (appended below) to convert the hex representation of the TIMEDATE and print the timedate.
Example:
C1257ACC:004FDD93 = [06.12.2012 15:32:20]
In our case it turned out that the original message was from December 2012 :-).
And the return receipt was generated when the user was cleaning up the mail-file opening a message which had never opened before generating a return receipt.
By the way you can do the same for a replica ID which is actually the TIMEDATE the first instance of a database was created. So you can figure out the creation time of a database.
This can be both helpful in some situations for troubleshooting.
-- Daniel
ConvertUnid2Timedate (char *unid_text)
{
TIMEDATE timedate;
char str[255];
char *p;
strcpy (str, unid_text);
p = strstr (str, ":");
if (p == NULL) p = strstr (str, ".");
if (p == NULL)
{
AddInLogMessageText("nshsem: invalid timedate!", 0, "");
return 0;
}
*p = '\0';
p++;
timedate.Innards[0] = hex2int(p);
timedate.Innards[1] = hex2int(str);
AddInLogMessageText("nshsem: %s = [%z]", 0, unid_text, &timedate);
return 0;
}
- Comments [1]
![[HCL Domino]](../lotus-domino.gif){kind=small}
![[Domino on Linux]](../domino-linux.gif){kind=small}
![[Nash!Com]](../nashcom.gif){kind=small}
![[Daniel Nashed]](../daniel-nsh.gif){kind=small}