Search code examples
pythontimestamphex

Mac absolute time from Hex


I'm trying to convert a time stamp from an iPhone database that's stored in Hex as part of a Python script.

I have searched online and been unable to find how it's done.

An example of the time stamps: 41 C4 C2 FA 5E 8C E8 64 which is equal to 29/01/2023 00:26:37 (UTC). I know this as a couple of tools such as deCode are able to convert it, but now "workings out" are shown.

Thanks

As stated I been unable to find the actual method of converting the hex into a readable time. Multiple tools are able to convert it, just not as part of the script


Solution

  • Your string is a big-endian representation of a double-precision floating point number representing the number of seconds since 1/1/2001. So:

    import time
    import datetime
    import struct
    
    x = "41 C4 C2 FA 5E 8C E8 64"
    z = bytes([int(x1,16) for x1 in x.split()])
    p = struct.unpack('>d',z)[0]
    print(p)
    
    d = datetime.datetime(2001,1,1,0,0,0)
    d = d.timestamp()+p
    print(time.ctime(d))
    

    Output:

    696644797.100842
    Sun Jan 29 00:26:37 2023