Unix Epoch Timestamp
Definition
An integer representing the number of seconds (or, in some databases, milliseconds or nanoseconds) since 00:00:00 UTC on 1 January 1970. Mobile communication databases store all timestamps in this format. Correct timezone conversion is critical for accurate timeline reconstruction.
- Reference point
- 00:00:00 UTC, 1 January 1970
- Units seen
- Seconds, milliseconds, or nanoseconds depending on system
- Common use
- Mobile call log and messaging database timestamps
- Key risk
- Timezone conversion errors during timeline reconstruction
Common questions
Why does the unit of an epoch timestamp matter so much for forensic accuracy?+
Interpreting a millisecond value as seconds, or vice versa, shifts the calculated date by orders of magnitude, so an examiner must confirm the unit against the database schema or tool documentation before converting, not assume it.
How does timezone handling cause errors even when the raw timestamp is correct?+
The stored epoch value is timezone-agnostic UTC by definition, so an error is introduced only at display time if the conversion tool applies the wrong local timezone or fails to account for daylight saving changes across the period under investigation.
Related terms
- Content Provider (Android)
- An Android system component that mediates access to shared data such as call logs and SMS. Forensic logical extractions query content providers...
- Free Page (SQLite)
- A SQLite database page that has been deallocated after a delete operation but not yet reused. Residual message data in free pages...
- Message Status Flag
- An integer column in a messaging database that encodes the state of a message: sent, delivered, read, failed, or draft. The exact...
- SQLCipher
- An open-source SQLite extension that encrypts the entire database file using AES-256. Used by Signal and some other security-focused messaging apps. Without...
- SQLite
- A lightweight, serverless relational database engine used pervasively on both iOS and Android to store structured app data including messages, call logs,...