Skip to main content

Module timestamp

browser_forensic_core

Module timestamp 

Source

Constants§

CORE_DATA_EPOCH_OFFSET_SECS
Apple Core Data epoch offset in seconds.
FILETIME_EPOCH_OFFSET
Windows FILETIME epoch offset from Unix epoch, in 100-nanosecond ticks.
WEBKIT_EPOCH_OFFSET_US
WebKit timestamp epoch offset in microseconds.

Functions§

core_data_secs_to_unix_nanos
filetime_to_unix_nanos
Convert a Windows FILETIME (100 ns ticks since 1601-01-01 UTC) into Unix nanoseconds. Used by the IE / Edge-Legacy WebCache (ESE) parser, whose Container_# timestamp columns (AccessedTime, ModifiedTime, CreationTime, ExpiryTime, …) are little-endian FILETIMEs.
unix_micros_to_nanos
unix_millis_to_nanos
unix_secs_f64_to_nanos
Convert Unix epoch seconds carried as a floating-point value (Chromium’s TransportSecurity sts_observed / expiry) into Unix nanoseconds, preserving sub-second precision without hand-rolling epoch math.
unix_secs_to_nanos
webkit_micros_to_unix_nanos