Difficulty Decoding 'ConversationIndex' Parameter in Microsoft Graph API

[gangstabob]

Bug Report

Prerequisites

• Can you reproduce the problem?
• Are you running the latest version?
• Are you reporting to the correct repository?
• Did you perform a cursory search?

For more information, see the CONTRIBUTING guide.

Description

I'm encountering discrepancies when attempting to decode the "ConversationIndex" property in the context of email forensics and e-discovery. The issue arises when the structure of the "ConversationIndex" property deviates from the documented format, specifically when it starts with "01 01" instead of just "01." This discrepancy prevents accurate extraction of information.

Console Errors: N/A

Screenshots: N/A

Steps to Reproduce

1. Obtain email messages with "ConversationIndex" properties.
2. Decode the "ConversationIndex" property according to the documented format.
3. Notice that when the "ConversationIndex" starts with "01 01," the extraction process fails due to a one-byte shift.

Expected behavior: The "ConversationIndex" property should consistently adhere to the documented format, starting with "01" as indicated.

Actual behavior: In some cases, the "ConversationIndex" property begins with "01 01," resulting in a one-byte shift that damages the information coded within it.

Additional Context

The documented format of the "ConversationIndex" property involves a specific structure with a reserved byte, FILETIME values, GUID, and child blocks.
Deviations from this format hinder the accurate decoding of timestamps and other relevant information.
This issue affects the reliability of forensic analysis in email conversations.
Reference documentation for the "ConversationIndex" property is available here.

Impact:

This issue has a significant impact on the reliability and accuracy of forensic analysis in email conversations, potentially affecting investigations and legal proceedings relying on this data.

Environment:

Email forensics and e-discovery software.
Microsoft Exchange Server.

Priority: High