Nokia Symbian 3 dat...
 
Notifications
Clear all

Nokia Symbian 3 date and time database format

12 Posts
4 Users
0 Reactions
1,502 Views
nsbuck
(@nsbuck)
Trusted Member
Joined: 17 years ago
Posts: 91
Topic starter  

I have looked at the database and the file that forensic software has generated and they do not match - Here's what I mean -

Date & time (Raw) Date & Time (translated) Actual Date & Time Difference (s)

63505246314263000 14/05/2012 111140 14/05/2012 101154 3586
63516733577787600 24/09/2012 100604 24/09/2012 100925 201
63518562987097375 15/10/2012 141613 15/10/2012 141613 0
63526104313336000 10/01/2013 210459 10/01/2013 200603 3536
63524169603351500 19/12/2012 113949 19/12/2012 101649 4980

So as you can see the difference in seconds varies. Can this be explained in any way why the handset date and time does not match the translated date and time from the database file?

Neil


   
ReplyQuote
jaclaz
(@jaclaz)
Illustrious Member
Joined: 18 years ago
Posts: 5133
 

I have looked at the database and the file that forensic software has generated and they do not match - Here's what I mean -.

So as you can see the difference in seconds varies. Can this be explained in any way why the handset date and time does not match the translated date and time from the database file?

Maybe it's the hypothesis that is "failed", i.e. the "Big number" is not actually the number of nanoseconds from year 0.

It is well possible that it is an "encoded" number, with some of the 64 bits meaning "date" and some other meaning "something else".

There can be literally hundreds or thousand ways in which a date/time (or any number) can be encoded.

There may also be issues with Excel rounding/precision.
Excel serials are "number of days" the Integer part and "fraction of day" the decimals to the right of the separator.

Try the following, subtract these two dates
1/1/2000 0.00.00
1/1/2000 14.16.13
and set the cell with the result as "number" with 18 (eighteen) decimals, you will get
0,5945949074084640
Say that the above is in cell D75.
Now, let's rebuild the 14 hours, 16 minutes and 13 seconds, enter in three cells one below the other C76, C77 and C78
=14
=16
=13

Now enter in D76, D77, D78 these formulas
=C76/24
=C77/(24*60)
=C78/(24*3600)
Enter in D79
=SUM(D76D78)
Enter in D80
=D79-D75
Format all the cells like D75.
Surprisingly, the number in D79 will be
0,5945949074074070
and in D80 you will see the difference of
-0,0000000000010564

BUT what is anyway "queer" is that the difference on 19/12/2012 is BIGGER than the one on 10/01/2013 😯

Try re-doing the calculation using as "base" another reference, let's say 1/1/2012 0.00.00 (still calculated form the same "initial point" of 15/10/2012 141613) and see what happens to the time differences…

jaclaz


   
ReplyQuote
Page 2 / 2
Share: