Outlook message recall dissected

It appears that Exchange 2010 is transforming a message recall request and packing it into a “standard” SMTP transportable message.

My research indicates that http://stackoverflow.com/questions/2064927/smtp-e-mail-recall-from-php is wrong. 3D 0A is simply line feed carriage return. I don’t think that triggers the recall and my testing supports this.

I have noticed a strong correlation between the Thread-Index of the original message and the recall. These are four messages and then four matching recalls:

Ac2PvBNoEcEDdmRxTvWAknQEITPwwg==
Ac2PvBgtZD4JdnxMSku7d8GsBxG89w==
Ac2PvBwk1kDHotcMSA+WvJ0iYCDWqQ==
Ac2PvB/GWZpqwZw3TnKf/fpIdw90Fg==

Ac2PvBx7EcEDdmRxTvWAknQEITPwwg==
Ac2PvCENZD4JdnxMSku7d8GsBxG89w==
Ac2PvCQZ1kDHotcMSA+WvJ0iYCDWqQ==
Ac2PvCdqWZpqwZw3TnKf/fpIdw90Fg==

Base64 decoded and shown as HEX this pattern emerges (message and recall matched up):

01CD8FBC 182D 643E09767C4C4A4BBB77C1AC0711BCF7
01CD8FBC 210D 643E09767C4C4A4BBB77C1AC0711BCF7

01CD8FBC 1C24 D640C7A2D70C480F96BC9D226020D6A9
01CD8FBC 2419 D640C7A2D70C480F96BC9D226020D6A9

01CD8FBC 1FC6 599A6AC19C374E729FFDFA48770F7416
01CD8FBC 276A 599A6AC19C374E729FFDFA48770F7416

(And that’s about how far I got.)

My testing does not show any “special strings” as suggested by http://www.officekb.com/Uwe/Forum.aspx/ms-outlook/48006/Message-recall#37ertgF5c3059U1individualnet I assume this is how it worked in an earlier version.