Convert Mac timestamps with python

Question

I am trying to convert Mac OSX timestamps (HFS Plus) to human readable format using python (on linux system).

HFS Plus timestamps represent the time in seconds since midnight on January 1, 1904.

For example, timestamp: 3453120824

In Human Time: Mon, 03 Jun 2013 16:13:44 GMT

Is there a python way to do this?

Answer 1

How to just use datetime with timedelta ? You want to pay particular attention to the list of formatting characters here.

>>> import datetime >>> d = datetime.datetime.strptime("01-01-1904", "%m-%d-%Y") >>> d datetime.datetime(1904, 1, 1, 0, 0) >>> d + datetime.timedelta(seconds=3453120824) datetime.datetime(2013, 6, 3, 16, 13, 44) >>> (d + datetime.timedelta(seconds=3453120824)).strftime("%a, %d %b %Y %H:%M:%S GMT") 'Mon, 03 Jun 2013 16:13:44 GMT' 

Answer 2

You can convert the return path (datetime object to absolute MAC time) using this method:

 import datetime dt = datetime.datetime(2013,6,3,16,13,44) tmp = datetime.datetime(1904,1,1,0,0) MacAbsTime = int((dt - tmp).total_seconds()) 

Also note that the absolute MAC MAC address time is different from the OSX version, using the number of seconds since January 1, 2001, not 1904.

Answer 3

You don't need datetime at all. Apple has kept its time since the beginning of its time, which was 2001-01-01. Super annoying but easy to overcome. Just add the difference between 1970-01-01 and 2001-01-01 in seconds before the variable and use the time to format it in one line of code:

 import time mac_date = time.strftime('%Y-%m-%d %H:%M:%S', time.localtime(data[0]/1000000000 + 978307200)) print mac_date 

In this example, data [0] is the date I received from the sqlite query against chat.db, and this is the first field in the tuple. 978307200 is the difference between the unix era and the mac timestamp in seconds, and that will never change. When you add these two together and convert the unix era, you get a date that is accessible to humans.

* Starting with High Sierra, the chat.db file now uses nanoseconds. This requires that the date value be divided by 1,000,000,000.