Hello,
A physical extraction was performed by Police on a Nokia Lumia 920.2 RM 821 (Windows Phone 8) with a UFED. In Physical Analyzer in the duration column of call logs there is duration followed by some figures.
By example "002105.2524268"
According to Cellebrite duration is displayed as it is in the database, it is linked to OS and model and that's all.
Does somebody already encountered this case and have some details about these figures?
Regards
Unrelated, but I was just looking into something related to an iPhone video. Within the Photos.sqlite database, I was able to locate an entry about a deleted video. The database has a value of duration that is stored in seconds, but then shows many fractions of a second. So it looks like 55.41166666667.
Perhaps you are looking at the same thing? A database entry that is stored with many fractions of a second?
Hi,
Thansk to share this closed example. I do not have the database, I asked Police if they can provide it to me or to take a look of this ESE. If I have more details I will post it.
I got the Phone.ese database and was able to check it.
There are columns with call' start and end time. The timestamp is encoded in Win32 FILETIME /Active Directory / Windows NT Time. The timestamp is the number of 100-nanoseconds intervals since Jan 1, 1601 UTC. So duration in Physical Analyzer is exact but too detailed… D
Regards