Re: [sleuthkit-developers] Need assistance with timestamp conversions

[Brian C. <ca...@sl...>]

If you use one of the DATETIME attributes, the date should be stored in
epoch (number of seconds since jan 1, 1970 UTC).  Are you converting the
format that Skype stores in to an integer that represents it as epoch?


On Thu, Nov 9, 2017 at 6:07 PM, Chandapiwa Monica Mpuchane-Molefha <
cmp...@un...> wrote:

> I am new to python and Autopsy Sleuthkit, and i am having a proplem with
> converting a timestamp to local time such that it would work in Autopsy. Im
> developing an extension module using python for a .db source file.
>
> I have attached the my .py file and word document with the screenshot
> showing my output result on Autopsy. I have included my sample database as
> well.
>
>
> The problem is on the Date Time and Start Date Time. The TSK_COMMENT AND
> TSK_DECRIPTION field show the right info, but since its data type does not
> match with the datetime, I get an error message if i use it to set my
> TSK_DATETIME.
>
> Your help will be really appreciated,
>
>
> Kind Regards
>
> Chandapiwa Monica Mpuchane-Molefha
> Graduate Student
> University of Nebraska at Omaha
> MS in Management Information Systems
>
>
> ------------------------------------------------------------
> ------------------
> Check out the vibrant tech community on one of the world's most
> engaging tech sites, Slashdot.org! http://sdm.link/slashdot
> _______________________________________________
> sleuthkit-developers mailing list
> sle...@li...
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-developers
>
>