Information Technology Reference
In-Depth Information
Timestamps
Before examining the data, it is important to understand the different timestamps used on
the iPhone. Timestamps found on the iPhone are presented either in the Unix timestamp or
Mac absolute time format. The examiner must ensure that the tools properly convert the
timestamps for the files. Access to the raw SQLite files will allow the examiner to verify
the timestamps manually.
Search WWH ::




Custom Search