Folks,
I have an advanced logical extraction from an Apple iPad 4 in which a number of iMessages have been parsed and presented to me by Cellbrite with time stamps which appear to be correct ( usual caveats apply) however, three of the messages are showing timestamps of 2005 which is obviously prior to the advent of the iMessage system (2011)
All of the messages are shown as being recovered deleted.Â
I'm aware that if this is the case, Cellbrite will have have parsed the message entries marked as deleted from within the database but i'm a little confused as to where the 2005 timestamps will have come from.Â
Is it likely that these were incorrect timestamps added when the relevant messages were in existence or could it be an error in the interpretation of the recovered data by Cellbrite.Â
Im going back into the office tomorrow to run the extraction through a few other pieces of software to verify results but any ideas as to the cause of the anomaly would be a good starter for 10.Â
Thanks in anticipationÂ
Han  Â
When you have timestamp issues, just check the database tables and the field values inthere. Sometimes there are bad or partial records, which get translated wrong when converting to date/time.