GIAC Advanced Smartphone Forensics (GASF) — Question 3

Following the introduction of iMessage with the firmware release iOS 5, devices began storing date/timestamps in which of the following formats?

Answer options

• A. UNIXEPOCH
• B. PDU SMS timestamp
• C. UNIXEPCH
• D. Mac epoch

Correct answer: A

Explanation

The correct answer is A, UNIXEPOCH, which is a standard format for representing time as the number of seconds elapsed since January 1, 1970. The other options, such as PDU SMS timestamp and Mac epoch, refer to different time representations that are not used by iMessage for date/timestamps.