Can anyone confirm what the persistent_manager_kind table within downloads.28 database indicates? I am assuming it relates to the types of media downloaded, but I just need clarification to support this theory.
Also, within the same database and under "datausage", I can cross-refer between the ZLIVEUSAGE and ZPROCESS to link app names to data usage and respective time stamps. I cannot figure out the timestamps though as they are in a strange format that is not NSDATE or EPOCH.
The core of this case revolves around excessive data usage via 3G, so any advice or experience of this that you can share would be really welcomed.
David
Can you share an example of the timestamps - might be something we've seen before?
But as a guess, I've occasionally seen the "old" Mac OS9 epoch used on iOS, which is seconds since 1904/01/01.
Hi Alex, thanks for your reply. I have uploaded 3 screenshots to my blog at
An example of the timestamps in the table
ZTIMESTAMP
47753-11-11 093628.683
As another guess the tool you are using is attempting to "decode" the RAW date data using one convention (that is not the one actually used).
Seemingly the "epoch" used on iPhones is starting on 2001-01-01 at 000000 (thus it needs a correction of +97830720 to become "normal" Unix Epoch starting 1970-01-01 at 000000), see
http//iphone-recover.blogspot.it/
jaclaz
Hi,
What you're seeing is a bit of weirdness cased by things being declared as "TIMESTAMP" in SQLite Expert.
If you go to Tools->Options then in the left hand panel, select "Type Mappings". In the table you'll see find "TIMESTAMP" in the left column, then in the corresponding right cell to the right change it from "DateTime" to "Float". This won't change the database, just the way that datatype is interpreted. you'll see that it's a good old NSDate floating point value underneath.
When you have a database created with the NSStore framework (the columns and tables all starting with Z are a giveaway) timestamps are always set up like this, and SQLite Expert will mangle things like that.
Alex,
You're a star! Thank you!
David
Redcelica sent me his db's to have a look at (and gave me permission to post on here) - as stated above the dates and times are NSdates
Alex,
You're a star! Thank you!
David
Glad to help. I've done some other interesting things with NSStore databases recently - perhaps I'll do a blog on it at some point…
Yes, that would be good. I have found a wealth of evidence such as data usage, proving certain apps have been present on a device. Thanks again anyway.