It seems I failed to notice two things with the original code with #12.
Appologies.
the timestamp given for the record is the snapshot timestamp; is it possible to use the file timestamp instead?
Also; parse-time-string would be happier with a RFC 822 datetime:
"Parse the time in STRING into (SEC MIN HOUR DAY MON YEAR DOW DST TZ).
STRING should be something resembling an RFC 822 (or later) date-time, e.g.,
"Fri, 25 Mar 2016 16:24:56 +0100", but this function is
somewhat liberal in what format it accepts, and will attempt to
return a "likely" value even for somewhat malformed strings.
The values returned are identical to those of `decode-time', but
any unknown values other than DST are returned as nil, and an
unknown DST value is returned as -1."
from j-keck/zfs-snap-diff#13: