±Forensic Focus Partners

±Your Account


Nickname
Password


Forgotten password/username?


Membership:
New Today: 0
New Yesterday: 4
Overall: 27520
Visitors: 59

±Follow Forensic Focus

Join our LinkedIn group

Subscribe to news

Subscribe to forums

Subscribe to blog

Subscribe to tweets

Forensic Focus - MacOSDate - Digital Forensics Forums Mobile Phone Forensics - MacOSDate

Forensic Focus

Go to page Previous  1, 2, 3  :| |:

Mobile Phone Forensics

MacOSDate

Re: MacOSDate

Posted: Mon Jul 23, 2012 8:08 am
Author: Smeriglio Location: Italy
AlexC I think you're right....I'm speaking about the number contained into playcount plist, so the lack is how the OS write this number inside it...in local time or UTC time? I guess in local time ....
Thanks

Re: MacOSDate

Posted: Mon Jul 23, 2012 12:42 pm
Author: joachimm Location: The Netherlands
- Smeriglio
Ok but if I found this number
3425616668

and I divide it by 86400 then I convert it in date (since 01/01/1904) I obtain:
20/Jul/2012 08.11


Using Python:
print datetime.datetime( 1904, 1, 1 ) + datetime.timedelta( seconds=3425616668 )
2012-07-20 08:11:08

So I would say that looks similar.

- Smeriglio

this hour 08.11 is the real time or I have to add the +2 (timezone+DST ) of my zone?


It is impossible to tell that solely from the timestamp.
Judging by the article you linked I would say it looks like the timestamp represents a date and time value in the local timezone.
However if I need to know this for a case, I make sure to do a reference test.

"HFS time" or "HFS+ time" is a short hand of expressing the date and time format as used in the HFS file system. So it applies to the type of timestamp not the file system. The only relation to the file system is that the timestamps are used in it. Referring to them as MacTime or MacOSXtime would be even more ambiguous.

Re: MacOSDate

Posted: Mon Jul 23, 2012 3:47 pm
Author: indur Location: New York
- joachimm
The epoch used in HFS/HFS+ is January 1, 1904 at 00:00:00 localtime or UTC.

See:
www.forensicswiki.org/wiki/Mac_OS_X

Both of them are still used.

If the timestamp is stored in localtime it already is corrected for timezone and daylight savings. E.g. if you would be in CEST and a timestamp is stored in CEST (summertime), you'll have to normalize the timestamp by -2h before comparing them to other timestamps in UTC. If the timestamp would be in CET (wintertime) this would be -1h.


Note that in HFS+, there is exactly one timestamp that is in the local time zone -- the volume creation date stored in the volume header. It's in local time for backwards-compatibility reasons. All other timestamps are in UTC.

Re: MacOSDate

Posted: Mon Jul 23, 2012 10:23 pm
Author: joachimm Location: The Netherlands
- indur

Note that in HFS+, there is exactly one timestamp that is in the local time zone -- the volume creation date stored in the volume header. It's in local time for backwards-compatibility reasons. All other timestamps are in UTC.


Again, the HFS in the name only indicates the origin of the timestamp you can find the same definition in:
web.archive.org/web/20...n1150.html

indur for completeness also the information you refer to is in the same document:
createDate
The date and time the folder was created. See HFS Plus Dates for a description of the format. Again, the createDate of the Volume Header is NOT stored in GMT; it is local time. (Further, if the volume has an HFS wrapper, the creation date in the MDB should be the same as the createDate in the Volume Header).

All times are GMT - 6 Hours
Page 3 of 3 Go to page Previous  1, 2, 3  :| |:
http://www.forensicfocus.com/