Glossary
Cocoa timestamp (Apple Core Data time)
Apple's Cocoa or Core Data timestamp counts seconds, or nanoseconds in newer iMessage stores, since 2001-01-01 00:00:00 UTC instead of the Unix epoch.
Definition
A Cocoa timestamp, also called Core Data time or Mac absolute time, is Apple's native way of storing a point in time: the number of seconds elapsed since the reference date 2001-01-01 00:00:00 UTC. It is the value behind NSDate and CFAbsoluteTime, and it appears wherever Apple frameworks persist dates to SQLite.
Where you meet it
- WhatsApp on iOS:
ZMESSAGEDATEinChatStorage.sqlite, as floating-point seconds. - iMessage and SMS: the
date,date_read,date_deliveredanddate_editedcolumns ofchat.db(macOS) andsms.db(iOS). Older versions store seconds; current versions store nanoseconds. - Many other iOS app databases built on Core Data (
Z-prefixed tables and columns).
Conversion
The Cocoa epoch is 978,307,200 seconds after the Unix epoch:
unix_seconds = cocoa_seconds + 978307200
unix_seconds = cocoa_nanoseconds / 1e9 + 978307200
Example: 728475300 (seconds) or 728475300000000000 (nanoseconds) both resolve to 2024-02-01 10:15:00 UTC.
Pitfalls
Reading a Cocoa value as Unix time places events in the early 1990s, which can look plausible. Reading nanoseconds as seconds overflows into the far future. A practical rule, used by MessagingForensics, is to treat any absolute value above 1e12 as nanoseconds and to reject results outside a sane date range instead of reporting them.