Sign In Start Free Trial
Account

Add to playlist

Create a Playlist

Modal Close icon
You need to login to use this feature.
  • Practical Mobile Forensics
  • Toc
  • feedback
Practical Mobile Forensics

Practical Mobile Forensics

4.4 (11)
close
Practical Mobile Forensics

Practical Mobile Forensics

4.4 (11)

Overview of this book

The book is an easy-to-follow guide with clear instructions on various mobile forensic techniques. The chapters and the topics within are structured for a smooth learning curve, which will swiftly empower you to master mobile forensics. If you are a budding forensic analyst, consultant, engineer, or a forensic professional wanting to expand your skillset, this is the book for you. The book will also be beneficial to those with an interest in mobile forensics or wanting to find data lost on mobile devices. It will be helpful to be familiar with forensics in general but no prior experience is required to follow this book.
Table of Contents (15 chapters)
close
10
10. Android Data Recovery Techniques
14
Index

Timestamps

Before examining the data, it is important to understand the different timestamps used on the iPhone. Timestamps found on the iPhone are presented either in the Unix timestamp or Mac absolute time format. The examiner must ensure that the tools properly convert the timestamps for the files. Access to the raw SQLite files will allow the examiner to verify the timestamps manually.

Unix timestamps

A Unix timestamp is the number of seconds that offsets the Unix epoch time, which starts on January 1, 1970. A Unix timestamp can be converted easily using the date command on a Mac workstation or using an online Unix epoch convertor on a Windows workstation. The date command is shown as follows:

$date -r 1388538061
Wed Jan 1 06:31:01 IST 2014

Mac absolute time

iOS devices adopted the use of Mac absolute time with iOS 5 for most of the data. Mac absolute time is the number of seconds that offsets the Mac epoch time, which starts on January 1, 2001. The difference between the Unix epoch time...

bookmark search playlist font-size

Change the font size

margin-width

Change margin width

day-mode

Change background colour

Close icon Search
Country selected

Close icon Your notes and bookmarks

Delete Bookmark

Modal Close icon
Are you sure you want to delete it?
Cancel
Yes, Delete