±Forensic Focus Partners

Become an advertising partner

±Your Account


Username
Password

Forgotten password/username?

Site Members:

New Today: 0 Overall: 36317
New Yesterday: 0 Visitors: 164

±Follow Forensic Focus

Forensic Focus Facebook PageForensic Focus on TwitterForensic Focus LinkedIn GroupForensic Focus YouTube Channel

RSS feeds: News Forums Articles

±Latest Articles

±Latest Videos

±Latest Jobs

iOS determine date a calendar entry is *created*

Discussion of forensic issues related to all types of mobile phones and underlying technologies (GSM, GPRS, UMTS/3G, HSDPA, LTE, Bluetooth etc.)
Subforums: Mobile Telephone Case Law
Reply to topicReply to topic Printer Friendly Page
Forum FAQSearchView unanswered posts
 
  

Samuel1
Senior Member
 

iOS determine date a calendar entry is *created*

Post Posted: Dec 28, 14 13:44

Hi all,

Has anyone encountered this issue? I need to determine the date/time an entry in a calendar was *created* -- not the date/time of the calendar entry itself.

I am using Oxygen Forensic Suite and I don't see any columns that contain that information. The software contains a "Last Modified" column, but they are all "N/A" and according to the help manual that is only available for Symbian OS'.

Thanks!  
 
  

mark_adp
Senior Member
 

Re: iOS determine date a calendar entry is *created*

Post Posted: Dec 28, 14 15:09

Hi,

Can you extract the calendar.sqlite file from the iphone? If so, I believe their is a LastModified field in the CalenderItem table.  
 
  

mark_adp
Senior Member
 

Re: iOS determine date a calendar entry is *created*

Post Posted: Dec 28, 14 15:35

Actually, there is also a creation_date too. Think the value is second from 01/01/2001 Epoch.  
 
  

Samuel1
Senior Member
 

Re: iOS determine date a calendar entry is *created*

Post Posted: Jan 02, 15 23:55

You both were extremely helpful in my investigation. Determining the correct time due to "cocoa"/NSTime was quite difficult since I don't own any forensic software that can calculate it, and I cannot program the code that Apple suggests.

Do any of you have any idea why Apple uses the number of seconds since 2001, rather than 1970 like everyone else?  
 
  

johpe
Newbie
 

Re: iOS determine date a calendar entry is *created*

Post Posted: Jan 03, 15 19:15

If you have the time in seconds since 2001-01-01 00:00:00 you can simply use the DCode tool to decode the correct time:
www.digital-detective....decode.asp

It's freeware and easy to use, select decode format "MAC: Absolute Time", enter value in "Value to decode" and click "Decode".

If you want to do this programmatically you can just add the number of seconds from 1970-01-01 00:00:00 to 2001-01-01 00:00:00 to your calculation. Use any online time calculator for this, for instance this one:
www.timeanddate.com/da...ation.html

Result: www.timeanddate.com/da...&i2=0&s2=0

(. 978307200 seconds .)  
 
  

PaulSanderson
Senior Member
 

Re: iOS determine date a calendar entry is *created*

Post Posted: Jan 03, 15 22:42

It is straight forward to convert between different timestamps using SQL I have used my Forensic Browser for SQLite tool to show the SQL code required below but you can use any of the free sqlite applications (the free SQLite manager for Firefox is very good).

In the screen shot

The first column in the select statement shows the raw date

The second column shows the raw date but a 'conversion' has been applied via the browser context menu (the dispalyed dialog) for this (ForensicBrowserConv) column.

The final column (calculated) takes the raw date and uses the SQLite DateTime function (see link below) to convert the raw date to a formatted date.

www.sqlite.org/lang_datefunc.html



As said you can use any SQLite tool to do this conversion - but if you would like a fully functional demo of my Browser then please drop me an email and I would be more than happy to send a licence across to you.

Cheers
_________________
Paul Sanderson
SQLite Forensics Book
www.amazon.com/SQLite-...entries*=0

Forensic Toolkit for SQLite
sandersonforensics.com...for-SQLite 
 

Page 1 of 1