Practical Mobile Forensics - Fourth Edition

Interpreting iOS timestamps

Before examining the data, it is important to understand different timestamp formats that are used on iOS devices. Timestamps found on iOS devices are presented either in the Unix timestamp or Mac absolute time format. You, as the examiner, must ensure that the tools properly convert the timestamps. Access to the raw SQLite files will allow you to verify these timestamps manually. You'll learn how to decode each timestamp format in the next few sections.