iOS determine date a calendar entry is *created*

Hi,

Can you extract the calendar.sqlite file from the iphone? If so, I believe their is a LastModified field in the CalenderItem table.

Actually, there is also a creation_date too. Think the value is second from 01/01/2001 Epoch.

You both were extremely helpful in my investigation. Determining the correct time due to "cocoa"/NSTime was quite difficult since I don't own any forensic software that can calculate it, and I cannot program the code that Apple suggests.

Do any of you have any idea why Apple uses the number of seconds since 2001, rather than 1970 like everyone else?

If you have the time in seconds since 2001-01-01 000000 you can simply use the DCode tool to decode the correct time
http//www.digital-detective.co.uk/freetools/decode.asp

It's freeware and easy to use, select decode format "MAC Absolute Time", enter value in "Value to decode" and click "Decode".

If you want to do this programmatically you can just add the number of seconds from 1970-01-01 000000 to 2001-01-01 000000 to your calculation. Use any online time calculator for this, for instance this one
http//www.timeanddate.com/date/timeduration.html

Result http//www.timeanddate.com/date/durationresult.html?y1=1970&m1=1&d1=1&y2=2001&m2=1&d2=1&h1=0&i1=0&s1=0&h2=0&i2=0&s2=0

(. 978307200 seconds .)

It is straight forward to convert between different timestamps using SQL I have used my Forensic Browser for SQLite tool to show the SQL code required below but you can use any of the free sqlite applications (the free SQLite manager for Firefox is very good).

In the screen shot

The first column in the select statement shows the raw date

The second column shows the raw date but a 'conversion' has been applied via the browser context menu (the dispalyed dialog) for this (ForensicBrowserConv) column.

The final column (calculated) takes the raw date and uses the SQLite DateTime function (see link below) to convert the raw date to a formatted date.

https://www.sqlite.org/lang_datefunc.html

As said you can use any SQLite tool to do this conversion - but if you would like a fully functional demo of my Browser then please drop me an email and I would be more than happy to send a licence across to you.

Cheers