If you clicked through to this blog entry hoping to meet a tall good looking successful professional, who likes walks in the countryside and puppy dogs, my apologies for the misleading subject line, but I'll try anything to get more page hits. 
However, if you ever wondered exactly what logic Enterprise Vault employs to determine the date to use on an email for storage and indexing purposes, ultimately represented in the ‘date’ index property, you've come to the right place.
This was an interesting enquiry I received recently from a partner, as there is a huge array of dates available on mail items, their existence and relevance dependent on many factors such as the mail system itself, the type of mail item, its purpose and state etc etc, so I thought I’d share our interpretation of ‘email dating’ on the blog
In Exchange, the date is selected from the first of the following properties that is present on the item:
- Message Delivery Time (PR_MESSAGE_DELIVERY_TIME)
- Original Message Delivery Time (PR_ORIGINAL_DELIVERY_TIME)
- Submission Time (PR_CLIENT_SUBMIT_TIME)
- Original Message Submission Time (PR_ORIGINAL_SUBMIT_TIME)
- Message Transport Provider Submission Time (PR_PROVIDER_SUBMIT_TIME)
- Last Modification Time (PR_LAST_MODIFICATION_TIME)
- Creation Time (PR_CREATION_TIME)
- Deferred Delivery Time (PR_DEFERRED_DELIVERY_TIME)
For an attachment to an Exchange message or a document, it is the created date of the object (PR_CREATION_TIME).
In the extreme case that none of the above properties are available, then the current time (archival time) is used.
In order to see which of the above dates are available on any Exchange item, then choose your weapon of choice for viewing MAPI properties on an item - either MFCMAPI
or OutlookSpy
