Practical Mobile Forensics - Fourth Edition

Unix timestamps

A Unix timestamp is the number of seconds that have elapsed since Unix epoch time, which started at midnight on January 1, 1970. A Unix timestamp can be converted easily, using the date command on a Mac workstation or using an online Unix epoch converter, such as https://www.epochconverter.com/.

The date command is shown in the following code snippet:

$ date -r 1557479897Fri May 10 12:18:17 MSK 2019

You may come across Unix timestamps in a millisecond or nanosecond format as well. This is not a big problem; there are a number of online converters, such as http://currentmillis.com/, as highlighted in the following screenshot:

A Unix timestamp in milliseconds converted with http://currentmillis.com/

The Unix epoch is the most ...