Working with timestamps
Before jumping into the analysis of SQLite databases, it's important to understand how iOS stores date and time records, and this is achieved by using timestamps. A timestamp is a numerical representation of a date and time, usually in the form of the number of seconds elapsed since a certain point in time called an epoch.
Generally speaking, timestamps found on iOS devices are presented either as a Unix timestamp or a Mac timestamp. The investigator should understand what timestamp format is used by each database to ensure that forensic tools display the date and time correctly.
Unix timestamps
A Unix timestamp is a 10-digit number that represents time as the number of seconds elapsed since 01/01/1970 00:00:00. This timestamp can be easily converted to a readable string by using online converters, such as www.epochconverter.com
As an example, we will use an online tool to convert a Unix timestamp, 1633614474, to a readable string:
