I need some help fr...
 
Notifications
Clear all

I need some help from an expert

7 Posts
5 Users
0 Likes
524 Views
(@johnstrangepi)
Posts: 3
New Member
Topic starter
 

My name is John and I am a Private Investigator from Colorado. I have a case that I have been working on, going to trial on Monday Oct. 21, 2019. The District Attorney has conducted a Forensic Dump and Extraction on a Android Cell Phone, using the latest version of Cellebrite, this is the new version that allows 'Physical " extraction from the phone.

In the Extraction Report there is 4 photos that were recovered, the photos have an identifier number, I am trying to to determine the meaning of the code, I was told the code can identify the date and time that the photo was created.

Please any help would be appreciated.

The picture codes are
1503090326998.jpg
1503090287876.jpg
1503090420312.jpg
1503724982955.bmp

Thank you,

John

 
Posted : 18/10/2019 7:43 pm
(@kenobyte)
Posts: 36
Eminent Member
 

Could it be Unix time in milliseconds?

 
Posted : 18/10/2019 8:40 pm
Bunnysniper
(@bunnysniper)
Posts: 257
Reputable Member
 

The picture codes are
1503090326998.jpg
1503090287876.jpg
1503090420312.jpg
1503724982955.bmp

If it is Unix time code (seconds since 1st Jan 1970) then we have

Fr, 18 August 2017 210526.998 UTC
Fr, 18 August 2017 210447.876 UTC
Fr, 18 August 2017 210700.312 UTC
Sa, 26 August 2017 052302.955 UTC

Does this make sense?
Be aware that this is UTC!

regards, Robin

 
Posted : 18/10/2019 9:10 pm
(@johnstrangepi)
Posts: 3
New Member
Topic starter
 

Robin

Thank you so much for your reply, I am in Denver Colorado, which is Mountain Time, so how would I figure out what the UTC time would be?

John

 
Posted : 18/10/2019 9:24 pm
Bunnysniper
(@bunnysniper)
Posts: 257
Reputable Member
 

The time difference is -6 hours between UTC and Mountain time. Please be aware that your time zone must not match to the time when the Android phone was used.

In your time zone it is

Sa, 19 August 2017 030526.998 +0600
Sa, 19 August 2017 030447.876 +0600
Sa, 19 August 2017 030700.312 +0600
Sa, 26 August 2017 112302.955 +0600

I am using DCode from https://www.digital-detective.net/software/DCode-v4.02a-build-4.02.0.9306.zip
with the setting "UnixMillisecond Value" if you want to play around with it yourself, John.
Good luck!
Robin

 
Posted : 18/10/2019 10:06 pm
tracedf
(@tracedf)
Posts: 169
Estimable Member
 

The time difference is -6 hours between UTC and Mountain time. Please be aware that your time zone must not match to the time when the Android phone was used.

In your time zone it is

Sa, 19 August 2017 030526.998 +0600
Sa, 19 August 2017 030447.876 +0600
Sa, 19 August 2017 030700.312 +0600
Sa, 26 August 2017 112302.955 +0600

Robin didn't you do that backwards? Mountain time is 6 hours behind UTC and, going the other direction, UTC is 6 hours ahead of mountain time.

 
Posted : 19/10/2019 1:03 am
(@hemuhemu)
Posts: 5
Active Member
 

if there was EXIF in jpeg, you can compare date of EXIF and date of filename

 
Posted : 19/10/2019 4:54 am
Share: