search

digitalsleuth / time_decode

A timestamp and date decoder written for python 3
https://digitalsleuth.gitbook.io/time-decode-documentation/
MIT License
34 stars 8 forks source link

Add Apple Cocoa Core Timestamp #8

Closed jgru closed 1 year ago

jgru commented 2 years ago

Dear @digitalsleuth,

this PR adds support for Apple's Cocoa Core timestamp, which is currently commonly used in Apple health data (healthdb_secure,...). More information on the timestamp can be found here.

Thanks for considering this PR.

Best regards, jgru

digitalsleuth commented 2 years ago

Hi @jgru , this timestamp format / function is already included in time-decode as iOS binary plist, Mac Absolute, and to a more refined extent (nano-second based) the iOS 11 timestamp. All of these timestamps are based on the NSdate stamp, as is Cocoa.

However, I will create a new label and entry for Cocoa, so that it also gets returned with its own label, vice being assumed by the others. Cheers!

jgru commented 2 years ago

this timestamp format / function is already included in time-decode as iOS binary plist, Mac Absolute, and to a more refined extent (nano-second based) the iOS 11 timestamp. All of these timestamps are based on the NSdate stamp, as is Cocoa.

Ah, thanks for the clarification. I grepped through the code using the keyword "cocoa" and didn't find anything. Should have looked better and read about the similarity to bplist time.

However, I will create a new label and entry for Cocoa, so that it also gets returned with its own label, vice being assumed by the others. Cheers!

I reworked the PR in 5ad9b62 to do that.

Best regards, jgru

jgru commented 2 years ago

Hi @digitalsleuth,

@jgru, I would appreciate it if you could revert line 1554 to remove the ts_type=None, and remove the "if not" which supplements it. I'm looking to ensure the code is clean and properly linted, and as well while this does not have an immediate effect, it could down the road.

I reverted this unnecessary change and conducted some minor cleanup. If there is anything to change, please let me know.

Thanks and best regards, jgru

digitalsleuth commented 1 year ago

Hi @jgru , sorry for the delay in getting back to this, but I've had an issue with Pypi recently and just got it resolved. Additionally, I took a little extra time to refactor this, and have decided to merge the Mac Absolute, BPlist, and iOS timestamp functions together (since they're all NSDate based) and have created a single nsdate function to address the "from" conversion.

Since the Cocoa and BPlist timestamp are identical, I've added a descriptor in the ts_type to now read "BPlist / Cocoa". I have left the "to" conversions as they are, because I don't believe they need refactoring, but I have added the "NSDate" descriptor to those as well. The outputs will all now look like this:

time-decode --timestamp

Converting Date: 2022-11-02 16:14:43.156350
---snip---
NSDate - Binary Plist / Cocoa:  689098483
NSDate - iOS 11+:               689098483156350080
NSDate - Mac Absolute time:     689098483.156350
time-decode --nsdate 689098483
NSDate - Binary Plist / Cocoa: 2022-11-02 16:14:43.000000

time-decode --nsdate 689098483156350080
NSDate - iOS 11+: 2022-11-02 16:14:43.156350 UTC

time-decode --nsdate 689098483.156350
NSDate - Mac Absolute time: 2022-11-02 16:14:43.156350

The references and documentation will be updated to reflect the use of relevance of CFAbsoluteTime and NSDate in all of these. Unless you have any other concerns, I'll likely close this PR and release the updated version in the next day or two.

jgru commented 1 year ago

Thank you for working on this!