This is a description how the Apple Ipod/Iphone stores the timestamps into their plist
files. After an experiment we tried to order the various ways that Apple Idevices manage
and store these data. We found the timestamps into PlayCounts.plist are in local time
and not in absolute time GMT.
During an experiment on an Apple IPod Touch we found three ways for storing the
timestamps and many documents on the Internet about the HFS/HFS+, Mac OS Date
and timestamps, we found that the IDevice systems have three ways to save dates and
times in a plist file (XML or binary mode) :
1. The most widely used by the plist (e.g. cookies.plist) format is “year-month-
DayTHour: minutes: secondsZ” (yyyy-mm-ddT00: 00:00 Z), and time and the date is
taken directly from the setting on the device.
2. A second system adopted by some plist is the use of offset CFAbsoluteTime Interval
Since 1904  (01/01/1904 00:00:00 GMT), where the dates and times are written to
the plist file in accordance with the wording of 10 (ten) numeric values (1234567890).
3. The third standard is CFAbsoluteTime Interval Since 2001  (01/01/2001 00:00:00
GMT). In this case the value will be 9 (nine) numerical values, and “n” decimal
(123456789, n). If you apply the formula ((VALUE + 978307200) / 86400)+25569,
where VALUE means the whole number, with the offset 978307200 01/01/2001, 86400
with the number of seconds in a day and 25569, the value which counts the dates the
program Excel, you can get a normal date in format DAY / MONTH / YEAR HOUR:
MINUTES: SECONDS, such as 123456789 +978307200 / 86400 +25569 = 11/29/2004
The HFS+, file system used widely on IPod Touch, saves timestamps in Epoch time
numbers of seconds since 01/01/1904 00:00:00 GMT. 
So, if we analyze the content of the file PlayCounts.plist
(/private/var/mobile/Media/iTunes_Control/iTunes ) we can find strings like these:
The question is the number 3425616658 is the number of seconds since 01/01/1904
00:00:00 and then we have to add the timezone and DST timestamp or these two data
The only way to answer to this question is experimentation, we played a song at 08.10
AM in Italy in DST time, the we dumped the physical image file by UFED Physical
Analyzer and we search inside it the string:
and we obtained a cluster of strings like this:
Now, if we divide this number for 86400 (number of seconds in a day) and convert this
number in an Spreadsheet software like MS Excel or LibCalc in a Date cell format set
starting from 01/01/1904 we got:
So, we did not need to add local timezone and/or DST we have both already included
into the number 3425616658.
We can conclude that the HFS+ saves the timestamps in Absolute time as number of
seconds since 01/01/1904 00:00:00 in GMT+0 (UTC) but the timestamps written inside
the files like PlayCounts.plist are in Absolute time since 01/01/1904 00:00:00 + local
timezone + DST taken from the device settings, indeed we tried to change the device
time settings and we got a different number of seconds those converted we got the
exact timestamps as on the device time settings.
Nanni Bassetti, Digital Forensics Expert, C.A.IN.E. Linux forensic distro project manager,
founder of CFI – Computer Forensics Italy, mailing list specialized in digital forensics topics, codeveloper
of SFDumper and founder of the web site http://scripts4cf.sf.net.
Personal website: http://www.nannibassetti.com – e-mail: [email protected]
Giuseppe Di Ieva, Scientific State Police. Specialized in Internet Investigations,
Intelligence, Mobile and Computer Forensics, Training.
Expertise in evidences gathering, computer forensics and cyber-crime investigations.
LinkedIn: http://tinyurl.com/9xn423w e-mail: [email protected]