I have been asked why the date format is 1970 on a number of messages that have been sent from an iPad. It appears that it was around 2012 but I can seem to find a converter that would display the correct date and time.
Can anyone assist with some knowledge?
Hi Danny,
May I ask what the source of these messages is? For instance, were they acquired from the email server, or extracted from the email client on an endpoint?
The email came from a Time-Machine backup set. This sample of the filenames and their details is an example. They didn’t have an EML or EMLX extension and the file extension appears to be some sort of Latitude/Longitude coordinates. The created dates of the emails that have the date issue are similar to the 1970 date/time in the first example. The common denominator in all of the problem emails is they have Sent from my iPad or forwarded from my iPad.
This is a sample of the file path:\Backups.backupdb\Server\2020-03-17-193343\Server HD\Library\Server\Mail\Data\mail\2B96D1DA-AC00-4EB8-A558-03F1987B1C2E.Sent\cur
The filename prefixes appear to be Epoch timestamps. For instance, 1352468298 decodes to November 9, 2012 1:38:18 PM (UTC), matching the listed creation and last modification timestamps.
As for the 1970 dates, that might be an interpretation issue somewhere in the tool chain. I would follow along starting from the original Time Machine data and manually review those messages that exhibit that problem without any conversion. You can use Back-In-Time for Time Machine if needed:
Thanks Arman.
I carried out some research of the files in the Time-Machine backup converting the first part of the filename as an Epoch timestamp and comparing the result of the conversion with the displayed date and time in emails that didn’t have the issue. This was consistent on a random sample. I have used that to resolve the dates and times on emails with the issue.
Cheers
Danny
