Does anybody know how to interpret the changed behavior exhibited by Outlook 2013 and 2010?
It appears that Outlook 2010 and 2013 significantly deviate from existing documentation of the PR_CONVERSATION_INDEX property value and Conversation tracking. They change the GUID contained in the property value, construct invalid timestamps and fail to
maintain consistent timestamps between sent and received messages. I started my analysis with Outlook 2007 and noted that it is consistent in maintaining the PR_CONVERSATION_INDEX property between sent messages and replies. It maintains the GUID value, it constructs valid timestamps and PR_CONVERSATION_INDEX property values agree with values transmitted in the Thread-index internet mail headers.
However, Outlook 2010 and 2013 deviate from Microsoft's documentation of conversation tracking.
The following exchange was between Outlook 2007 and Outlook 2010:
Sent Message From Machine 1 Outlook 2007 Sent Items Folder:
Conversation Index has 1 Timestamps, Hex string is:
01D046C6FC06C85C39B2C024428381B13C0C5C3FDEB4
{C85C39B2-C024-4283-81B1-3C0C5C3FDEB4} Date/Time of 2/12/2015 8:22:43 AM
Received Message From Machine 2 Outlook 2010 Inbox Folder:
Conversation Index has 1 Timestamps, Hex string is:
0101D57DF85E9AC7EF5F05554126A5C93D00053A52F9
{9AC7EF5F-0555-4126-A5C9-3D00053A52F9} Date/Time of 12/24/1830 6:03:22 AM
Base 64 decoded Thread-Index header has 1 Timestamps, Hex string is:
01D046C6FC06C85C39B2C024428381B13C0C5C3FDEB4
{C85C39B2-C024-4283-81B1-3C0C5C3FDEB4} Date/Time of 2/12/2015 8:22:43 AM
First Response Message From Machine 2 Outlook 2010 Sent Items Folder:
Conversation Index has 2 Timestamps, Hex string is:
0101D57DF85E9AC7EF5F05554126A5C93D00053A52F99CE2A76940
{9AC7EF5F-0555-4126-A5C9-3D00053A52F9} Date/Time of 12/24/1830 6:03:22 AM Date/Time of 11/11/1843 9:46:42 AM retrieved from Response 0
Second Response Message Received From Machine 2 Outlook 2010 Inbox Folder:
Conversation Index has 3 Timestamps, Hex string is:
0101D57DF85E9AC7EF5F05554126A5C93D00053A52F902CB36D9B802DF293170
{9AC7EF5F-0555-4126-A5C9-3D00053A52F9} Date/Time of 12/24/1830 6:03:22 AM Date/Time of 1/7/1831 11:22:11 AM retrieved from Response 0 Date/Time of 1/22/1831 2:12:08 AM retrieved from Response 1
Base 64 decoded Thread-Index header has 3 Timestamps, Hex string is:
0101D57DF85E9AC7EF5F05554126A5C93D00053A52F99CE2A76940800001CCA0
{9AC7EF5F-0555-4126-A5C9-3D00053A52F9} Date/Time of 12/24/1830 6:03:22 AM Date/Time of 11/11/1843 9:46:42 AM retrieved from Response 0 Date/Time of 11/11/1843 9:53:08 AM retrieved from Response 1
Third Response Message From Machine 2 Outlook 2010 Sent Items Folder:
Conversation Index has 4 Timestamps, Hex string is:
0101D57DF85E9AC7EF5F05554126A5C93D00053A52F902CB36D9B802DF2931709CB557EDE0
{9AC7EF5F-0555-4126-A5C9-3D00053A52F9} Date/Time of 12/24/1830 6:03:22 AM Date/Time of 1/7/1831 11:22:11 AM retrieved from Response 0 Date/Time of 1/22/1831 2:12:08 AM retrieved from Response 1 Date/Time of 11/11/1843 9:59:18 AM retrieved from Response 2
The Outlook 2010 receiver assigns a value to the PR_CONVERSATION_INDEX property of the received message that deviates from the value assigned by the Outlook 2007 sender. It fails to maintain the GUID portion of the property and assigns a new GUID. In addition, the timestamp within the newly created 22 byte header of the PR_CONVERSATION_INDEX property yields an invalid date when it is interpreted. The proper value for the property is present in the Thread-index internet header that was received
but is ignored by Outlook 2010. The first response sent by Outlook 2010 is created using the deviant PR_CONVERSATION_INDEX property on the received message and the added delta timestamp for the response is also an invalid date. This odd property value is also included in the Thread-index internet header that accompanies the response received by Outlook 2007. Outlook 2007 complies with the MS documentation and constructs a PR_CONVERSATION_INDEX property for the second response
message that incorporates the values it received from Outlook 2010. These values are echoed in the Thread-index internet header that accompanies the second response message that Outlook 2007 sends to Outlook 2010. However, except for the timestamp contained in the 22 byte header, Outlook 2010 ignores the PR_CONVERSATION_INDEX delta timestamps that it receives from Outlook 2007 and creates completely different values for the first response and second response delta
timestamps that it saves to the PR_CONVERSATION_INDEX property of the received second response message.
The delta timestamps in the saved property are clearly different from those contained in the Thread-index internet header of the received message. The conversation tracking between sent messages and replies is broken by Outlook 2010.
Outlook 2013 exhibits the same behavior and also breaks conversation
tracking:
Sent Message From Machine 1 Outlook 2007 Sent Items Folder:
Conversation Index has 1 Timestamps, Hex string is:
01D046C6FC06C85C39B2C024428381B13C0C5C3FDEB4
{C85C39B2-C024-4283-81B1-3C0C5C3FDEB4} Date/Time of 2/12/2015 8:22:43 AM
Received Message From Machine 2 Outlook 2013 Inbox Folder:
Conversation Index has 1 Timestamps, Hex string is:
0101D57DF85E9AC7EF5F05554126A5C93D00053A52F9
{9AC7EF5F-0555-4126-A5C9-3D00053A52F9} Date/Time of 12/24/1830 6:03:22 AM
Base 64 decoded Thread-Index header has 1 Timestamps, Hex string is:
01D046C6FC06C85C39B2C024428381B13C0C5C3FDEB4
{C85C39B2-C024-4283-81B1-3C0C5C3FDEB4} Date/Time of 2/12/2015 8:22:43 AM
First Response Message From Machine 2 Outlook 2013 Sent Items Folder:
Conversation Index has 2 Timestamps, Hex string is:
0101D57DF85E9AC7EF5F05554126A5C93D00053A52F99CE2C2F220
{9AC7EF5F-0555-4126-A5C9-3D00053A52F9} Date/Time of 12/24/1830 6:03:22 AM Date/Time of 11/11/1843 11:25:15 AM retrieved from Response 0
Second Response Message Received From Machine 2 Outlook 2013 Inbox Folder:
Conversation Index has 3 Timestamps, Hex string is:
0101D57DF85E9AC7EF5F05554126A5C93D00053A52F9027813F960022AB8AAC6
{9AC7EF5F-0555-4126-A5C9-3D00053A52F9} Date/Time of 12/24/1830 6:03:22 AM Date/Time of 1/5/1831 7:41:44 PM retrieved from Response 0 Date/Time of 1/16/1831 8:25:08 PM retrieved from Response 1
Base 64 decoded Thread-Index header has 3 Timestamps, Hex string is:
0101D57DF85E9AC7EF5F05554126A5C93D00053A52F99CE2C2F220800001D070
{9AC7EF5F-0555-4126-A5C9-3D00053A52F9} Date/Time of 12/24/1830 6:03:22 AM Date/Time of 11/11/1843 11:25:15 AM retrieved from Response 0 Date/Time of 11/11/1843 11:31:45 AM retrieved from Response 1
Third Response Message From Machine 2 Outlook 2013 Sent Items Folder:
Conversation Index has 4 Timestamps, Hex string is:
0101D57DF85E9AC7EF5F05554126A5C93D00053A52F9027813F960022AB8AAC69CBDAF2640
{9AC7EF5F-0555-4126-A5C9-3D00053A52F9} Date/Time of 12/24/1830 6:03:22 AM Date/Time of 1/5/1831 7:41:44 PM retrieved from Response 0 Date/Time of 1/16/1831 8:25:08 PM retrieved from Response 1 Date/Time of 11/11/1843 11:34:33 AM retrieved from Response 2
Then I reversed the direction of the sent/received messages and the following was obtained from a conversation that originated on Outlook 2010:
Sent Message From Machine 1 Outlook 2010 Sent Items Folder:
Conversation Index has 1 Timestamps, Hex string is:
01D046D79B18F300EDCCA68249B887DE701D3A9D08DE
{F300EDCC-A682-49B8-87DE-701D3A9D08DE} Date/Time of 2/12/2015 10:21:42 AM
First Response Message Received From Machine 1 Outlook 2010 Inbox Folder:
Conversation Index has 2 Timestamps, Hex string is:
010207F0F0BAA7CC3C304DFC7779E2E37371AC823777011BB28915
{A7CC3C30-4DFC-7779-E2E3-7371AC823777} Date/Time of 2/26/1831 10:52:20 AM Date/Time of 3/4/1831 2:15:28 AM retrieved from Response 0
Base 64 decoded Thread-Index header has 2 Timestamps, Hex string is:
01D046D79B18F300EDCCA68249B887DE701D3A9D08DE0000155570
{F300EDCC-A682-49B8-87DE-701D3A9D08DE} Date/Time of 2/12/2015 10:21:42 AM Date/Time of 2/12/2015 10:24:05 AM retrieved from Response 0
Second Response Message From Machine 1 Outlook 2010 Sent Items Folder:
Conversation Index has 3 Timestamps, Hex string is:
010207F0F0BAA7CC3C304DFC7779E2E37371AC823777011BB289159C74F12BD0
{A7CC3C30-4DFC-7779-E2E3-7371AC823777} Date/Time of 2/26/1831 10:52:20 AM Date/Time of 3/4/1831 2:15:28 AM retrieved from Response 0 Date/Time of 11/11/1843 10:34:14 AM retrieved from Response 1
Third Response Message Received From Machine 1 Outlook 2010 Inbox Folder:
Conversation Index has 4 Timestamps, Hex string is:
010207F0F0BAA7CC3C304DFC7779E2E37371AC823777011BB2891501B1E165E30169D98E2F
{A7CC3C30-4DFC-7779-E2E3-7371AC823777} Date/Time of 2/26/1831 10:52:20 AM Date/Time of 3/4/1831 2:15:28 AM retrieved from Response 0 Date/Time of 3/12/1831 5:18:49 PM retrieved from Response 1 Date/Time of 3/19/1831 9:59:42 PM retrieved from Response 2
Base 64 decoded Thread-Index header has 4 Timestamps, Hex string is:
010207F0F0BAA7CC3C304DFC7779E2E37371AC823777011BB289159C74F12BD0800000B730
{A7CC3C30-4DFC-7779-E2E3-7371AC823777} Date/Time of 2/26/1831 10:52:20 AM Date/Time of 3/4/1831 2:15:28 AM retrieved from Response 0 Date/Time of 11/11/1843 10:34:14 AM retrieved from Response 1 Date/Time of 11/11/1843 10:36:47 AM retrieved from Response
2
Outlook 2010 exhibited more unusual behavior. For the initial outgoing message that starts the conversation Outlook 2010 created a PR_CONVERSATION_INDEX property that contained a valid timestamp in the 22 byte header. The message received by Outlook 2007 contained a matching PR_CONVERSATION_INDEX property and a matching Thread-index value in the internet header. Outlook 2007 replies to this message and appends a valid delta timestamp to the PR_CONVERSATION_INDEX property for the first response message. So far, so good. However, when Outlook 2010 receives the first response to its own message with a PR_CONVERSATION_INDEX GUID matching that of the sent message it still assigns a new GUID to the incoming message's PR_CONVERSATION_INDEX
property. It also creates an invalid timestamp in the22 byte header and an invalid delta timestamp is appended for the first response. The proper values are present in the Thread-index internet header but are ignored by Outlook 2010. The PR_CONVERSATION_INDEX property of the Outlook 2010 response to Outlook
2007 contains the newly created GUID value along with another invalid delta timestamp for the second response. Outlook 2007 dutifully uses the values that it received to append a delta timestamp to the PR_CONVERSATION_INDEX property of the third response
message and these values are reflected in the accompanying Thread-index internet header of the message sent to Outlook 2010. Oddly, when Outlook 2010 receives the third response message it stores a PR_CONVERSATION_INDEX property value that maintains the invalid
timestamps that it created in the 22 byte header and the delta timestamp for the first response. However, upon receiving the third response, Outlook 2010 stores different invalid delta timestamps for the second and third response values in the property.
Even odder is the fact that it altered the second response delta timestamp which it had originated!
In a conversation with Outlook 2007, Outlook 2013 exhibits the same unusual behavior as Outlook 2010 as follows:
Sent Message From Machine 1 Outlook 2013 Sent Items Folder:
Conversation Index has 1 Timestamps, Hex string is:
01D0479000E57F2A47A540594D9AACC3EF5CDED2AF38
{7F2A47A5-4059-4D9A-ACC3-EF5CDED2AF38} Date/Time of 2/13/2015 8:21:40 AM
First Response Message Received From Machine 1 Outlook 2013 Inbox Folder:
Conversation Index has 2 Timestamps, Hex string is:
0101AA4398B709738B5E1C65C7EFCF071A2825E9C6B0011CD2D1C5
{09738B5E-1C65-C7EF-CF07-1A2825E9C6B0} Date/Time of 10/30/1830 6:47:11 AM Date/Time of 11/4/1830 9:42:34 PM retrieved from Response 0
Base 64 decoded Thread-Index header has 2 Timestamps, Hex string is:
01D0479000E57F2A47A540594D9AACC3EF5CDED2AF380000384EB0
{7F2A47A5-4059-4D9A-ACC3-EF5CDED2AF38} Date/Time of 2/13/2015 8:21:40 AM Date/Time of 2/13/2015 8:27:58 AM retrieved from Response 0
Second Response Message From Machine 1 Outlook 2013 Sent Items Folder:
Conversation Index has 3 Timestamps, Hex string is:
0101AA4398B709738B5E1C65C7EFCF071A2825E9C6B0011CD2D1C59D31B4CC80
{09738B5E-1C65-C7EF-CF07-1A2825E9C6B0} Date/Time of 10/30/1830 6:47:11 AM Date/Time of 11/4/1830 9:42:34 PM retrieved from Response 0 Date/Time of 11/12/1843 8:38:20 AM retrieved from Response 1
Third Response Message Received From Machine 1 Outlook 2013 Inbox Folder:
Conversation Index has 4 Timestamps, Hex string is:
0101AA4398B709738B5E1C65C7EFCF071A2825E9C6B0011CD2D1C500BBD34DC701F2084892
{09738B5E-1C65-C7EF-CF07-1A2825E9C6B0} Date/Time of 10/30/1830 6:47:11 AM Date/Time of 11/4/1830 9:42:34 PM retrieved from Response 0 Date/Time of 11/8/1830 3:20:36 PM retrieved from Response 1 Date/Time of 11/18/1830 1:00:49 PM retrieved from Response 2
Base 64 decoded Thread-Index header has 4 Timestamps, Hex string is:
0101AA4398B709738B5E1C65C7EFCF071A2825E9C6B0011CD2D1C59D31B4CC80800000A4E0
{09738B5E-1C65-C7EF-CF07-1A2825E9C6B0} Date/Time of 10/30/1830 6:47:11 AM Date/Time of 11/4/1830 9:42:34 PM retrieved from Response 0 Date/Time of 11/12/1843 8:38:20 AM retrieved from Response 1 Date/Time of 11/12/1843 8:40:37 AM retrieved from Response
2
The following conversation with Outlook 2010 originated from Outlook 2013:
Sent Message From Machine 1 Outlook 2013 Sent Items Folder:
Conversation Index has 1 Timestamps, Hex string is:
01D047953ADE058A70CDEA7B44CF94F04B1FA2ACB007
{058A70CD-EA7B-44CF-94F0-4B1FA2ACB007} Date/Time of 2/13/2015 8:59:05 AM
Received Message From Machine 2 Outlook 2010 Inbox Folder:
Conversation Index has 1 Timestamps, Hex string is:
01021ECD2713B3339C5DAED2A0AC482B72999CB07A31
{B3339C5D-AED2-A0AC-482B-72999CB07A31} Date/Time of 3/27/1831 1:04:06 PM
Base 64 decoded Thread-Index header has 1 Timestamps, Hex string is:
01D047953ADE058A70CDEA7B44CF94F04B1FA2ACB007
{058A70CD-EA7B-44CF-94F0-4B1FA2ACB007} Date/Time of 2/13/2015 8:59:05 AM
First Response Message From Machine 2 Outlook 2010 Sent Items Folder:
Conversation Index has 2 Timestamps, Hex string is:
01021ECD2713B3339C5DAED2A0AC482B72999CB07A319C51927F70
{B3339C5D-AED2-A0AC-482B-72999CB07A31} Date/Time of 3/27/1831 1:04:06 PM Date/Time of 11/12/1843 9:14:55 AM retrieved from Response 0
First Response Message Received From Machine 1 Outlook 2013 Inbox Folder:
Conversation Index has 2 Timestamps, Hex string is:
01021ECD2713B3339C5DAED2A0AC482B72999CB07A3102372279C9
{B3339C5D-AED2-A0AC-482B-72999CB07A31} Date/Time of 3/27/1831 1:04:06 PM Date/Time of 4/7/1831 8:42:56 PM retrieved from Response 0
Base 64 decoded Thread-Index header has 2 Timestamps, Hex string is:
01021ECD2713B3339C5DAED2A0AC482B72999CB07A319C51927F70
{B3339C5D-AED2-A0AC-482B-72999CB07A31} Date/Time of 3/27/1831 1:04:06 PM Date/Time of 11/12/1843 9:14:55 AM retrieved from Response 0
Second Response Message From Machine 1 Outlook 2013 Sent Items Folder:
Conversation Index has 3 Timestamps, Hex string is:
01021ECD2713B3339C5DAED2A0AC482B72999CB07A3102372279C99C3FDA9600
{B3339C5D-AED2-A0AC-482B-72999CB07A31} Date/Time of 3/27/1831 1:04:06 PM Date/Time of 4/7/1831 8:42:56 PM retrieved from Response 0 Date/Time of 11/12/1843 9:19:06 AM retrieved from Response 1
Second Response Message Received From Machine 2 Outlook 2010 Inbox folder:
Conversation Index has 3 Timestamps, Hex string is:
01021ECD2713B3339C5DAED2A0AC482B72999CB07A3102372279C900B8F7A30B
{B3339C5D-AED2-A0AC-482B-72999CB07A31} Date/Time of 3/27/1831 1:04:06 PM Date/Time of 4/7/1831 8:42:56 PM retrieved from Response 0 Date/Time of 4/11/1831 12:59:07 PM retrieved from Response 1
Base 64 decoded Thread-Index header has 3 Timestamps, Hex string is:
01021ECD2713B3339C5DAED2A0AC482B72999CB07A3102372279C99C3FDA9600
{B3339C5D-AED2-A0AC-482B-72999CB07A31} Date/Time of 3/27/1831 1:04:06 PM Date/Time of 4/7/1831 8:42:56 PM retrieved from Response 0 Date/Time of 11/12/1843 9:19:06 AM retrieved from Response 1
Third Response Message From Machine 2 Outlook 2010 Sent Items Folder:
Conversation Index has 4 Timestamps, Hex string is:
01021ECD2713B3339C5DAED2A0AC482B72999CB07A3102372279C900B8F7A30B9C3A140820
{B3339C5D-AED2-A0AC-482B-72999CB07A31} Date/Time of 3/27/1831 1:04:06 PM Date/Time of 4/7/1831 8:42:56 PM retrieved from Response 0 Date/Time of 4/11/1831 12:59:07 PM retrieved from Response 1 Date/Time of 11/12/1843 9:23:20 AM retrieved from Response 2
Third Response Message Received From Machine 1 Outlook 2013 Inbox Folder:
Conversation Index has 4 Timestamps, Hex string is:
01021ECD2713B3339C5DAED2A0AC482B72999CB07A3102372279C900B8F7A30B0242C32426
{B3339C5D-AED2-A0AC-482B-72999CB07A31} Date/Time of 3/27/1831 1:04:06 PM Date/Time of 4/7/1831 8:42:56 PM retrieved from Response 0 Date/Time of 4/11/1831 12:59:07 PM retrieved from Response 1 Date/Time of 4/23/1831 1:10:53 AM retrieved from Response 2
Base 64 decoded Thread-Index header has 4 Timestamps, Hex string is:
01021ECD2713B3339C5DAED2A0AC482B72999CB07A3102372279C900B8F7A30B9C3A140820
{B3339C5D-AED2-A0AC-482B-72999CB07A31} Date/Time of 3/27/1831 1:04:06 PM Date/Time of 4/7/1831 8:42:56 PM retrieved from Response 0 Date/Time of 4/11/1831 12:59:07 PM retrieved from Response 1 Date/Time of 11/12/1843 9:23:20 AM retrieved from Response 2
Outlook 2013 constructs a valid timestamp in the 22 byte header of the PR_CONVERSATION_INDEX property of the sent message that starts the conversation with Outlook 2010. Upon receiving the message, Outlook 2010 constructs a PR_CONVERSATION_INDEX property value for the received message that changes the GUID and inserts an invalid timestamp in the 22 byte header of the property value. The proper values are present in the
Thread-index property of the internet mail headers that accompany the received message but are ignored by Outlook 2010. The reply to Outlook
2013 from Outlook 2010 uses these changed values in the PR_CONVERSATION_INDEX property of the response and Outlook 2010 also appends an invalid delta timestamp for the first response. Outlook 2013 receives the reply and constructs a PR_CONVERSATION_INDEX property whose value includes the changed GUID and invalid timestamp in the 22 byte header. However, Outlook 2013 ignores the delta timestamp created by Outlook 2010 for the first response and appends a different invalid delta timestamp to the PR_CONVERSATION_INDEX property value of the received message. The delta timestamp transmitted by Outlook 2010 that represents the first response was present in the Thread-index internet mail header but was ignored by Outlook 2013 upon receiving the message. The second response sent from Outlook 2013 to Outlook 2010 is constructed based on the PR_CONVERSATION_INDEX property value of the received first response message and Outlook 2013 appends an invalid delta timestamp to reflect the second response.
Upon receiving the second response message Outlook 2010 constructs a PR_CONVERSATION_INDEX property whose value includes the changed GUID and invalid timestamp in the 22 byte header and the invalid delta timestamp for the first response that matches the
values of the message sent by Outlook 2013. However, it ignores the delta timestamp created by Outlook 2013 for the second response and appends a different invalid delta timestamp to the property value to reflect the second response. The
delta timestamp transmitted by Outlook 2013 that represents the second response was present in the Thread-index internet mail header but was ignored by Outlook 2010 upon receiving the message.
The same thing happens when Outlook 2010 sends the third response back to Outlook 2013. The PR_CONVERSATION_INDEX property value that Outlook 2013 constructs for the received message changes the delta timestamp for the received message to a different value
from that transmitted by Outlook 2010. The transmitted delta timestamp is present in the Thread-index internet mail header but is ignored.
The same behavior is exhibited when the conversation between Outlook 2010 and Outlook2013 starts with Outlook 2010 as the sender.