My name is John and I am a Private Investigator from Colorado. I have a case that I have been working on, going to trial on Monday Oct. 21, 2019. The District Attorney has conducted a Forensic Dump and Extraction on a Android Cell Phone, using the latest version of Cellebrite, this is the new version that allows 'Physical " extraction from the phone.
In the Extraction Report there is 4 photos that were recovered, the photos have an identifier number, I am trying to to determine the meaning of the code, I was told the code can identify the date and time that the photo was created.
Please any help would be appreciated.
The picture codes are
1503090326998.jpg
1503090287876.jpg
1503090420312.jpg
1503724982955.bmp
Thank you,
John
Could it be Unix time in milliseconds?
The picture codes are
1503090326998.jpg
1503090287876.jpg
1503090420312.jpg
1503724982955.bmp
If it is Unix time code (seconds since 1st Jan 1970) then we have
Fr, 18 August 2017 210526.998 UTC
Fr, 18 August 2017 210447.876 UTC
Fr, 18 August 2017 210700.312 UTC
Sa, 26 August 2017 052302.955 UTC
Does this make sense?
Be aware that this is UTC!
regards, Robin
Robin
Thank you so much for your reply, I am in Denver Colorado, which is Mountain Time, so how would I figure out what the UTC time would be?
John
The time difference is -6 hours between UTC and Mountain time. Please be aware that your time zone must not match to the time when the Android phone was used.
In your time zone it is
Sa, 19 August 2017 030526.998 +0600
Sa, 19 August 2017 030447.876 +0600
Sa, 19 August 2017 030700.312 +0600
Sa, 26 August 2017 112302.955 +0600
I am using DCode from https://
with the setting "UnixMillisecond Value" if you want to play around with it yourself, John.
Good luck!
Robin
The time difference is -6 hours between UTC and Mountain time. Please be aware that your time zone must not match to the time when the Android phone was used.
In your time zone it is
Sa, 19 August 2017 030526.998 +0600
Sa, 19 August 2017 030447.876 +0600
Sa, 19 August 2017 030700.312 +0600
Sa, 26 August 2017 112302.955 +0600
Robin didn't you do that backwards? Mountain time is 6 hours behind UTC and, going the other direction, UTC is 6 hours ahead of mountain time.
if there was EXIF in jpeg, you can compare date of EXIF and date of filename