Before examining the data, it is important to understand the different timestamps that are used on iOS devices. Timestamps found on iOS devices are presented either in the Unix timestamp or Mac absolute time format. The examiner must ensure that the tools properly convert the timestamps for the files. Access to the raw SQLite files will allow the examiner to verify these timestamps manually. Further information on iOS timestamps can be found at http://www.zdziarski.com/blog/wp-content/uploads/2013/05/iOS-Forensic-Investigative-Methods.pdf.
A Unix timestamp is the number of seconds that offsets the Unix epoch time, which starts on January 1, 1970. A Unix timestamp can be converted easily using the date command on a Mac workstation or using an online Unix epoch converter; such as, https://www.epochconverter.com/.
The date command is as follows:
$ date -r 1512808725
Sat Dec9 11:38:45 MSK 2017
You may also face Unix timestamps in millisecond or nanosecond format. This is...