Why do some conversation index values start with what looks like 2 reserved bytes? Are both part of the FILETIME structure? Or should one be omitted when converting FILETIME?
Example as per below - 0101DA71215126A86591D256CE4180185E7915ACE148B12D73820980002A73708000006FBB80000C57D0
"01" is actually a part of the FILETIME structure, so if you have just one instance, it should not be omitted despite of what MS docs suggest. I remove the first instance only if there are two of them.
Keep in mind that it is really not a good idea to rely on the root and delta time stamps in
PR_CONVERSATION_INDEX. Outlook itself never uses them, and it appears that the property value depends on how the message was delivered - POP3/SMTP provider seems to be off compared to the Exchange server even for the same message.