±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 35875
New Yesterday: 3 Visitors: 183

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

Timestamp type

Computer forensics discussion. Please ensure that your post is not better suited to one of the forums below (if it is, please post it there instead!)
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

minime2k9
Senior Member
 

Timestamp type

Post Posted: Jan 03, 19 15:49

I have a timestamp in the following format:
568212425.116299

This date relates roughly to today (03/01/2019 Date in proper format - DD/MM/YYYY for our US friends) and has been taken from an App on an IOS device. Does anyone have any ideas what type of timestamp it is and how to convert it into a usable date?  
 
  

mcman
Senior Member
 

Re: Timestamp type

Post Posted: Jan 03, 19 16:05

MAC absolute time?
Dcode popped this out:
Thu, 03 January 2019 12:47:05 UTC  
 
  

willbarton
Newbie
 

Re: Timestamp type

Post Posted: Jan 03, 19 16:06

Looks like an Apple Cocoa Core Data Timestamp. It works out to be roughly GMT: Thursday, 3 January 2019 12:47:05. Theres a couple of converters about and epochconverter has a cocoa core data convertor on it.

Hope this helps!  
 
  

jaclaz
Senior Member
 

Re: Timestamp type

Post Posted: Jan 03, 19 16:18

- minime2k9
I have a timestamp in the following format:
568212425.116299

This date relates roughly to today (03/01/2019 Date in proper format - DD/MM/YYYY for our US friends) and has been taken from an App on an IOS device. Does anyone have any ideas what type of timestamp it is and how to convert it into a usable date?

That is a NSdate, basically it is "epoch" with a different base:
sandersonforensics.com...-timestamp


NSDate (IOS)

Records the number of seconds since 01/01/2001


You can use this converter:
www.dcode.fr/timestamp-converter

setting the "base" date to 01/01/2001
the fractional part is (should be) fractions of seconds.

Please also note that unlike epoch, that is (should be) local time, not UTC.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 
 
  

minime2k9
Senior Member
 

Re: Timestamp type

Post Posted: Jan 03, 19 17:35

Thanks for all the help, I must have an old version of Dcode as none of them worked for me!  
 

Page 1 of 1