dfdatetime package

Submodules

dfdatetime.apfs_time module

Apple File System (APFS) time implementation.

class dfdatetime.apfs_time.APFSTime(precision=None, time_zone_offset=None, timestamp=None)[source]

Bases: PosixTimeInNanoseconds

Apple File System (APFS) timestamp.

The APFS timestamp is a signed 64-bit integer that contains the number of nanoseconds since 1970-01-01 00:00:00.

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies a APFS timestamp from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

Raises:

ValueError – if the date and time value is not supported.

CopyToDateTimeString()[source]

Copies the APFS timestamp to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss.#########” or: None if the timestamp is missing or invalid.

Return type:

str

dfdatetime.cocoa_time module

Cocoa timestamp implementation.

class dfdatetime.cocoa_time.CocoaTime(precision=None, time_zone_offset=None, timestamp=None)[source]

Bases: DateTimeValues

Cocoa timestamp.

The Cocoa timestamp is a floating point value that contains the number of seconds since 2001-01-01 00:00:00 (also known as the Cocoa epoch). Negative values represent date and times predating the Cocoa epoch.

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies a Cocoa timestamp from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

Raises:

ValueError – if the time string is invalid or not supported.

CopyToDateTimeString()[source]

Copies the Cocoa timestamp to a date and time string.

Returns:

date and time value formatted as: YYYY-MM-DD hh:mm:ss.###### or: None if the timestamp cannot be copied to a date and time string.

Return type:

str

__init__(precision=None, time_zone_offset=None, timestamp=None)[source]

Initializes a Cocoa timestamp.

Parameters:

precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.
timestamp (Optional[float]) – Cocoa timestamp.

property timestamp

Cocoa timestamp or None if not set.

Type:: float

class dfdatetime.cocoa_time.CocoaTimeEpoch[source]

Bases: DateTimeEpoch

Cocoa time epoch.

__init__()[source]: Initializes a Cocoa time epoch.

dfdatetime.decorators module

Function decorators.

dfdatetime.decorators.deprecated(function)[source]: Decorator to mark functions or methods as deprecated.

dfdatetime.definitions module

The date and time definitions.

Also see:: https://en.wikipedia.org/wiki/Day https://en.wikipedia.org/wiki/Hour https://en.wikipedia.org/wiki/Minute

dfdatetime.delphi_date_time module

Delphi TDateTime implementation.

class dfdatetime.delphi_date_time.DelphiDateTime(precision=None, time_zone_offset=None, timestamp=None)[source]

Bases: DateTimeValues

Delphi TDateTime timestamp.

The Delphi TDateTime timestamp is a floating point value that contains the number of days since 1899-12-30 00:00:00 (also known as the epoch). Negative values represent date and times predating the epoch.

The maximal correct date supported by TDateTime values is limited to: 9999-12-31 23:59:59.999

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies a Delphi TDateTime timestamp from a string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

Raises:

ValueError – if the time string is invalid or not supported.

CopyToDateTimeString()[source]

Copies the Delphi TDateTime timestamp to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss.######” or: None if the timestamp is missing.

Return type:

str

__init__(precision=None, time_zone_offset=None, timestamp=None)[source]

Initializes a Delphi TDateTime timestamp.

Parameters:

precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.
timestamp (Optional[float]) – Delphi TDateTime timestamp.

property timestamp

Delphi TDateTime timestamp or None if not set.

Type:: float

class dfdatetime.delphi_date_time.DelphiDateTimeEpoch[source]

Bases: DateTimeEpoch

Delphi TDateTime epoch.

__init__()[source]: Initializes a Delphi TDateTime epoch.

dfdatetime.dotnet_datetime module

.NET DateTime implementation.

class dfdatetime.dotnet_datetime.DotNetDateTime(precision=None, time_zone_offset=None, timestamp=None)[source]

Bases: DateTimeValues

.NET DateTime ticks.

The .NET DateTime timestamp is a 64-bit signed integer that contains the date and time as the number of 100 nanoseconds since 12:00 AM January 1, year 1 A.D. in the proleptic Gregorian Calendar.

CopyFromDateTimeString(time_string)[source]

Copies a .NET DateTime timestamp from a string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

Raises:

ValueError – if the time string is invalid or not supported.

CopyToDateTimeString()[source]

Copies the .NET DateTime timestamp to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss.######” or: None if the timestamp is missing.

Return type:

str

__init__(precision=None, time_zone_offset=None, timestamp=None)[source]

Initializes a .NET DateTime timestamp.

Parameters:

precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.
timestamp (Optional[int]) – .NET DateTime ticks.

property timestamp

.NET DateTime timestamp or None if not set.

Type:: integer

class dfdatetime.dotnet_datetime.DotNetDateTimeEpoch[source]

Bases: DateTimeEpoch

.NET DateTime epoch.

__init__()[source]: Initializes a .NET DateTime epoch.

dfdatetime.factory module

The date and time values factory.

class dfdatetime.factory.Factory[source]

Bases: object

Date and time values factory.

classmethod DeregisterDateTimeValues(date_time_values_type)[source]

Deregisters a date and time values type.

Parameters:: date_time_values_type (type) – date and time values type.
Raises:: KeyError – if date and time values type is not registered.

classmethod NewDateTimeValues(class_name, **kwargs)[source]

Creates a new date and time values for the specific type indicator.

Parameters:

class_name (str) – type indicator.
kwargs (dict) – keyword arguments depending on the date and time values.

Returns:

date and time values.

Return type:

DateTimeValues

Raises:

KeyError – if date and time values is not registered.

classmethod RegisterDateTimeValues(date_time_values_type)[source]

Registers a date and time values type.

Parameters:: date_time_values_type (type) – date and time values type.
Raises:: KeyError – if date and time values is already registered.

dfdatetime.fake_time module

Fake timestamp implementation.

class dfdatetime.fake_time.FakeTime(precision=None, time_zone_offset=None)[source]

Bases: DateTimeValues

Fake timestamp.

The fake timestamp is intended for testing purposes. On initialization it contains the current time in UTC in microsecond precision.

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies a fake timestamp from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

CopyToDateTimeString()[source]

Copies the fake timestamp to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss” or: ”YYYY-MM-DD hh:mm:ss.######” or None if the number of seconds is missing.

Return type:

str

__init__(precision=None, time_zone_offset=None)[source]

Initializes a fake timestamp.

Parameters:

precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.

dfdatetime.fat_date_time module

FAT date time implementation.

class dfdatetime.fat_date_time.FATDateTime(fat_date_time=None, precision=None, time_zone_offset=None)[source]

Bases: DateTimeValues

FAT date time.

The FAT date time is mainly used in DOS/Windows file formats and FAT.

The FAT date and time is a 32-bit value containing two 16-bit values:

The date (lower 16-bit). * bits 0 - 4: day of month, where 1 represents the first day * bits 5 - 8: month of year, where 1 represent January * bits 9 - 15: year since 1980
The time of day (upper 16-bit). * bits 0 - 4: seconds (in 2 second intervals) * bits 5 - 10: minutes * bits 11 - 15: hours

The FAT date time has no time zone information and is typically stored in the local time of the computer.

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies a FAT date time from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

Raises:

ValueError – if the time string is invalid or not supported.

CopyToDateTimeString()[source]

Copies the FAT date time to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss” or None: if number of seconds is missing.

Return type:

str

__init__(fat_date_time=None, precision=None, time_zone_offset=None)[source]

Initializes a FAT date time.

Parameters:

fat_date_time (Optional[int]) – FAT date time.
precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.

property fat_date_time

FAT date time or None if not set.

Type:: int

class dfdatetime.fat_date_time.FATDateTimeEpoch[source]

Bases: DateTimeEpoch

FAT date time time epoch.

__init__()[source]: Initializes a FAT date time epoch.

class dfdatetime.fat_date_time.FATTimestamp(precision=None, time_zone_offset=None, timestamp=None)[source]

Bases: DateTimeValues

FAT timestamp.

The FAT timestamp is an unsigned integer that contains the number of 10 milli seconds intervals since 1980-01-01 00:00:00 (also known as the FAT date time epoch).

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies a FAT timestamp from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

Raises:

ValueError – if the time string is invalid or not supported.

CopyToDateTimeString()[source]

Copies the FAT timestamp to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss.######” or: None if the timestamp is missing.

Return type:

str

__init__(precision=None, time_zone_offset=None, timestamp=None)[source]

Initializes a FAT timestamp.

Parameters:

precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.
timestamp (Optional[int]) – FAT timestamp.

property timestamp

FAT timestamp or None if not set.

Type:: int

dfdatetime.filetime module

FILETIME timestamp implementation.

class dfdatetime.filetime.Filetime(precision=None, time_zone_offset=None, timestamp=None)[source]

Bases: DateTimeValues

FILETIME timestamp.

The FILETIME timestamp is a 64-bit integer that contains the number of 100th nano seconds since 1601-01-01 00:00:00.

Do not confuse this with the FILETIME structure that consists of 2 x 32-bit integers and is presumed to be unsigned.

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies a FILETIME timestamp from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

Raises:

ValueError – if the time string is invalid or not supported.

CopyToDateTimeString()[source]

Copies the FILETIME timestamp to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss.#######” or: None if the timestamp is missing or invalid.

Return type:

str

__init__(precision=None, time_zone_offset=None, timestamp=None)[source]

Initializes a FILETIME timestamp.

Parameters:

precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.
timestamp (Optional[int]) – FILETIME timestamp.

property timestamp

FILETIME timestamp or None if not set.

Type:: int

class dfdatetime.filetime.FiletimeEpoch[source]

Bases: DateTimeEpoch

FILETIME epoch.

__init__()[source]: Initializes a FILETIME epoch.

dfdatetime.golang_time module

Golang time.Time timestamp implementation.

class dfdatetime.golang_time.GolangTime(golang_timestamp=None, precision=None)[source]

Bases: DateTimeValues

Golang time.Time timestamp.

A Golang time.Time timestamp contains the number of nanoseconds since January 1, 1 UTC. Depending on the version of the timestamp, the time zone is stored in minutes or seconds relative to UTC.

A serialized version 1 Golang time.Time timestamp is a 15 byte value that consists of:

byte 0 - version as an 8-bit integer.
bytes 1-8 - number of seconds since January 1, 1 as a big-endian signed
integer.
bytes 9-12 - fraction of second, number of nanoseconds as a big-endian
signed integer.
bytes 13-14 - time zone offset in minutes as a 16-bit big-endian integer,
where -1 represents UTC.

A serialized version 2 Golang time.Time timestamp is a 16 byte value that consists of:

byte 0 - version as an 8-bit integer.
bytes 1-8 - number of seconds since January 1, 1 as a big-endian signed
integer.
bytes 9-12 - fraction of second, number of nanoseconds as a big-endian
signed integer.
bytes 13-14 - time zone offset in minutes as a 16-bit big-endian integer,
where -1 represents UTC.
byte 15 - time zone offset in seconds as an 8-bit integer.

is_local_time

True if the date and time value is in local time

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies a date time value from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

Raises:

ValueError – if the time string is invalid or not supported.

CopyToDateTimeString()[source]

Copies the Golang time value to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss.######” or: None if the timestamp cannot be copied to a date and time string.

Return type:

str

__init__(golang_timestamp=None, precision=None)[source]

Initializes a Golang time.Time timestamp.

Parameters:

golang_timestamp (Optional[bytes]) – the Golang time.Time timestamp.
precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.

property golang_timestamp

Golang time.Time timestamp or None if not set.

Type:: int

class dfdatetime.golang_time.GolangTimeEpoch[source]

Bases: DateTimeEpoch

Golang time.Time epoch.

__init__()[source]: Initializes a Golang time.Time epoch.

dfdatetime.hfs_time module

HFS time implementation.

class dfdatetime.hfs_time.HFSTime(precision=None, time_zone_offset=None, timestamp=None)[source]

Bases: DateTimeValues

HFS timestamp.

The HFS timestamp is an unsigned 32-bit integer that contains the number of seconds since 1904-01-01 00:00:00. Where in HFS the timestamp is typically in local time and in HFS+/HFSX in UTC.

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies a HFS timestamp from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

Raises:

ValueError – if the time string is invalid or not supported.

CopyToDateTimeString()[source]

Copies the HFS timestamp to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss” or None: if the timestamp is missing or invalid.

Return type:

str

__init__(precision=None, time_zone_offset=None, timestamp=None)[source]

Initializes a HFS timestamp.

Parameters:

precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.
timestamp (Optional[int]) – HFS timestamp.

property timestamp

HFS timestamp or None if not set.

Type:: int

class dfdatetime.hfs_time.HFSTimeEpoch[source]

Bases: DateTimeEpoch

HFS time epoch.

__init__()[source]: Initializes a HFS time epoch.

dfdatetime.interface module

Date and time interfaces.

class dfdatetime.interface.DateTimeEpoch(year, month, day_of_month)[source]

Bases: object

Date and time epoch interface.

This is the super class of different epoch representations.

year

year that is the start of the epoch e.g. 1970.

Type:: int

month

month that is the start of the epoch, where 1 represents January.

Type:: int

day_of_month

day of the month that is the start of the epoch, where 1 represents the first day.

Type:: int

__init__(year, month, day_of_month)[source]

Initializes a date time epoch.

Parameters:

year (int) – year that is the start of the epoch e.g. 1970.
month (int) – month that is the start of the epoch, where 1 represents January.
day_of_month (int) – day of the month that is the start of the epoch, where 1 represents the first day.

class dfdatetime.interface.DateTimeValues(is_delta=False, precision=None, time_zone_offset=None)[source]

Bases: object

Date and time values interface.

This is the super class of different date and time representations.

is_local_time

True if the date and time value is in local time.

Type:: bool

time_zone_hint

time zone hint, such as “Europe/Amsterdam”, “CET” or “UTC+1”, or None if not set.

Type:: str

abstract CopyFromDateTimeString(time_string)[source]

Copies a date time value from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

Raises:

ValueError – if the time string is invalid or not supported.

abstract CopyToDateTimeString()[source]

Copies the date time value to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss.######” or: None if the timestamp cannot be copied to a date and time string.

Return type:

str

CopyToDateTimeStringISO8601()[source]

Copies the date time value to an ISO 8601 date and time string.

Returns:

date and time value formatted as an ISO 8601 date and time string or: None if the timestamp cannot be copied to a date and time string.

Return type:

str

CopyToPosixTimestamp()[source]

Copies the date time value to a POSIX timestamp.

Returns:: a POSIX timestamp in seconds or None if no timestamp is available.
Return type:: int

CopyToPosixTimestampWithFractionOfSecond()[source]

Copies the date time value to a POSIX timestamp with fraction of second.

Returns:

a POSIX timestamp in seconds with fraction of second or: None, None if no timestamp is available.

Return type:

tuple[int, int]

GetDate()[source]

Retrieves the date represented by the date and time values.

Note that the date is adjusted to UTC.

Returns:

year, month, day of month or (None, None, None): if the date and time values do not represent a date.

Return type:

tuple[int, int, int]

GetDateWithTimeOfDay()[source]

Retrieves the date with time of day.

Note that the date and time are adjusted to UTC.

Returns:

year, month, day of month, hours,: minutes, seconds or (None, None, None, None, None, None) if the date and time values do not represent a date or time of day.

Return type:

tuple[int, int, int, int, int, int]

GetPlasoTimestamp()[source]

Retrieves a timestamp that is compatible with Plaso.

Returns:

a POSIX timestamp in microseconds or None if no timestamp is: available.

Return type:

int

Raises:

ValueError – if the timestamp cannot be determined.

GetTimeOfDay()[source]

Retrieves the time of day represented by the date and time values.

Note that the time is adjusted to UTC.

Returns:

hours, minutes, seconds or (None, None, None): if the date and time values do not represent a time of day.

Return type:

tuple[int, int, int]

__eq__(other)[source]

Determines if the date time values are equal to other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are equal to other.
Return type:: bool

__ge__(other)[source]

Determines if the date time values are greater than or equal to other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are greater than or equal to other.
Return type:: bool
Raises:: ValueError – if other is not an instance of DateTimeValues.

__gt__(other)[source]

Determines if the date time values are greater than other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are greater than other.
Return type:: bool
Raises:: ValueError – if other is not an instance of DateTimeValues.

__init__(is_delta=False, precision=None, time_zone_offset=None)[source]

Initializes date time values.

Parameters:

is_delta (Optional[bool]) – True if the date and time value is relative to another date and time value.
precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.

__le__(other)[source]

Determines if the date time values are greater than or equal to other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are greater than or equal to other.
Return type:: bool
Raises:: ValueError – if other is not an instance of DateTimeValues.

__lt__(other)[source]

Determines if the date time values are less than other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are less than other.
Return type:: bool
Raises:: ValueError – if other is not an instance of DateTimeValues.

__ne__(other)[source]

Determines if the date time values are not equal to other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are not equal to other.
Return type:: bool

property is_delta

True if the date and time is relative to another.

Type:: Is delta (bool)

property precision

precision of the date and time value.

Type:: Precision (str)

property time_zone_offset

time zone offset in minutes from UTC.

Type:: Time zone offset (int)

class dfdatetime.interface.NormalizedTimeEpoch[source]

Bases: DateTimeEpoch

dfDateTime normalized time epoch.

__init__()[source]: Initializes a dfDateTime normalized time epoch.

dfdatetime.java_time module

Java java.util.Date timestamp implementation.

class dfdatetime.java_time.JavaTime(precision=None, time_zone_offset=None, timestamp=None)[source]

Bases: PosixTimeInMilliseconds

Java java.util.Date timestamp.

The Java java.util.Date timestamp is a signed integer that contains the number of milliseconds since 1970-01-01 00:00:00 (also known as the POSIX epoch). Negative values represent date and times predating the POSIX epoch.

Also see:: https://docs.oracle.com/javase/8/docs/api/java/util/Date.html

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyToDateTimeString()[source]

Copies the POSIX timestamp to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss.######” or: None if the timestamp is missing.

Return type:

str

dfdatetime.ole_automation_date module

OLE automation date (or Floatingtime or Application time) implementation.

class dfdatetime.ole_automation_date.OLEAutomationDate(precision=None, time_zone_offset=None, timestamp=None)[source]

Bases: DateTimeValues

OLE Automation date.

The OLE Automation date is a floating point value that contains the number of days since 1899-12-30 (also known as the OLE Automation date epoch), and the fractional part represents the fraction of a day since midnight. Negative values represent date and times predating the OLE Automation date epoch.

Also see:: https://learn.microsoft.com/en-us/dotnet/api/system.datetime.tooadate?view=net-8.0

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies an OLE Automation date from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

Raises:

ValueError – if the time string is invalid or not supported.

CopyToDateTimeString()[source]

Copies the OLE Automation date to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss.######” or: None if the timestamp is missing.

Return type:

str

__init__(precision=None, time_zone_offset=None, timestamp=None)[source]

Initializes an OLE Automation date.

Parameters:

precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.
timestamp (Optional[float]) – OLE Automation date.

property timestamp

OLE Automation date timestamp or None if not set.

Type:: float

class dfdatetime.ole_automation_date.OLEAutomationDateEpoch[source]

Bases: DateTimeEpoch

OLE automation date epoch.

__init__()[source]: Initializes a OLE automation date epoch.

dfdatetime.posix_time module

POSIX timestamp implementation.

class dfdatetime.posix_time.PosixTime(precision=None, time_zone_offset=None, timestamp=None)[source]

Bases: DateTimeValues

POSIX timestamp.

The POSIX timestamp is a signed integer that contains the number of seconds since 1970-01-01 00:00:00 (also known as the POSIX epoch). Negative values represent date and times predating the POSIX epoch.

The POSIX timestamp was initially 32-bit though 64-bit variants are known to be used.

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies a POSIX timestamp from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

CopyToDateTimeString()[source]

Copies the POSIX timestamp to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss” or None: if the timestamp is missing.

Return type:

str

__init__(precision=None, time_zone_offset=None, timestamp=None)[source]

Initializes a POSIX timestamp.

Parameters:

precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.
timestamp (Optional[int]) – POSIX timestamp.

property timestamp

POSIX timestamp or None if not set.

Type:: int

class dfdatetime.posix_time.PosixTimeEpoch[source]

Bases: DateTimeEpoch

POSIX time epoch.

__init__()[source]: Initializes a POSIX time epoch.

class dfdatetime.posix_time.PosixTimeInMicroseconds(precision=None, time_zone_offset=None, timestamp=None)[source]

Bases: DateTimeValues

POSIX timestamp in microseconds.

Variant of the POSIX timestamp in microseconds.

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies a POSIX timestamp from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

CopyToDateTimeString()[source]

Copies the POSIX timestamp to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss.######” or: None if the timestamp is missing.

Return type:

str

__init__(precision=None, time_zone_offset=None, timestamp=None)[source]

Initializes a POSIX timestamp in microseconds.

Parameters:

precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.
timestamp (Optional[int]) – POSIX timestamp in microseconds.

property timestamp

POSIX timestamp in microseconds or None if not set.

Type:: int

class dfdatetime.posix_time.PosixTimeInMilliseconds(precision=None, time_zone_offset=None, timestamp=None)[source]

Bases: DateTimeValues

POSIX timestamp in milliseconds.

Variant of the POSIX timestamp in milliseconds.

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies a POSIX timestamp from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

CopyToDateTimeString()[source]

Copies the POSIX timestamp to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss.######” or: None if the timestamp is missing.

Return type:

str

__init__(precision=None, time_zone_offset=None, timestamp=None)[source]

Initializes a POSIX timestamp in milliseconds.

Parameters:

precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.
timestamp (Optional[int]) – POSIX timestamp in milliseconds.

property timestamp

POSIX timestamp in milliseconds or None if not set.

Type:: int

class dfdatetime.posix_time.PosixTimeInNanoseconds(precision=None, time_zone_offset=None, timestamp=None)[source]

Bases: DateTimeValues

POSIX timestamp in nanoseconds.

Variant of the POSIX timestamp in nanoseconds.

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies a POSIX timestamp from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

CopyToDateTimeString()[source]

Copies the POSIX timestamp to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss.#########” or: None if the timestamp is missing or invalid.

Return type:

str

__init__(precision=None, time_zone_offset=None, timestamp=None)[source]

Initializes a POSIX timestamp in nanoseconds.

Parameters:

precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.
timestamp (Optional[int]) – POSIX timestamp in nanoseconds.

property timestamp

POSIX timestamp or None if not set.

Type:: int

dfdatetime.precisions module

Date and time precision helpers.

class dfdatetime.precisions.DateTimePrecisionHelper[source]

Bases: object

Date time precision helper interface.

This is the super class of different date and time precision helpers.

Time precision helpers provide functionality for converting date and time values between different precisions.

classmethod CopyNanosecondsToFractionOfSecond(nanoseconds)[source]

Copies the number of nanoseconds to a fraction of second value.

Parameters:

nanoseconds (int) – number of nanoseconds.

Returns:

fraction of second, which must be a value between 0.0: and 1.0.

Return type:

decimal.Decimal

classmethod CopyToDateTimeString(time_elements_tuple, fraction_of_second)[source]

Copies the time elements and fraction of second to a string.

Parameters:

time_elements_tuple (tuple[int, int, int, int, int, int]) – time elements, contains year, month, day of month, hours, minutes and seconds.
fraction_of_second (decimal.Decimal) – fraction of second, which must be a value between 0.0 and 1.0.

Returns:

date and time value formatted as: YYYY-MM-DD hh:mm:ss with fraction: of second part that corresponds to the precision.

Return type:

str

class dfdatetime.precisions.MicrosecondsPrecisionHelper[source]

Bases: DateTimePrecisionHelper

Microseconds precision helper.

classmethod CopyNanosecondsToFractionOfSecond(nanoseconds)[source]

Copies the number of nanoseconds to a fraction of second value.

Parameters:

nanoseconds (int) – number of nanoseconds.

Returns:

fraction of second, which must be a value between 0.0 and: 1.0.

Return type:

decimal.Decimal

Raises:

ValueError – if the number of nanoseconds is out of bounds.

classmethod CopyToDateTimeString(time_elements_tuple, fraction_of_second)[source]

Copies the time elements and fraction of second to a string.

Parameters:

time_elements_tuple (tuple[int, int, int, int, int, int]) – time elements, contains year, month, day of month, hours, minutes and seconds.
fraction_of_second (decimal.Decimal) – fraction of second, which must be a value between 0.0 and 1.0.

Returns:

date and time value formatted as:: YYYY-MM-DD hh:mm:ss.######

Return type:

str

Raises:

ValueError – if the fraction of second is out of bounds.

class dfdatetime.precisions.MillisecondsPrecisionHelper[source]

Bases: DateTimePrecisionHelper

Milliseconds precision helper.

classmethod CopyNanosecondsToFractionOfSecond(nanoseconds)[source]

Copies the number of nanoseconds to a fraction of second value.

Parameters:

nanoseconds (int) – number of nanoseconds.

Returns:

fraction of second, which must be a value between 0.0 and: 1.0.

Return type:

decimal.Decimal

Raises:

ValueError – if the number of nanoseconds is out of bounds.

classmethod CopyToDateTimeString(time_elements_tuple, fraction_of_second)[source]

Copies the time elements and fraction of second to a string.

Parameters:

time_elements_tuple (tuple[int, int, int, int, int, int]) – time elements, contains year, month, day of month, hours, minutes and seconds.
fraction_of_second (decimal.Decimal) – fraction of second, which must be a value between 0.0 and 1.0.

Returns:

date and time value formatted as:: YYYY-MM-DD hh:mm:ss.###

Return type:

str

Raises:

ValueError – if the fraction of second is out of bounds.

class dfdatetime.precisions.NanosecondsPrecisionHelper[source]

Bases: DateTimePrecisionHelper

Nanoseconds precision helper.

classmethod CopyNanosecondsToFractionOfSecond(nanoseconds)[source]

Copies the number of nanoseconds to a fraction of second value.

Parameters:

nanoseconds (int) – number of nanoseconds.

Returns:

fraction of second, which must be a value between 0.0 and: 1.0.

Return type:

decimal.Decimal

Raises:

ValueError – if the number of nanoseconds is out of bounds.

classmethod CopyToDateTimeString(time_elements_tuple, fraction_of_second)[source]

Copies the time elements and fraction of second to a string.

Parameters:

time_elements_tuple (tuple[int, int, int, int, int, int]) – time elements, contains year, month, day of month, hours, minutes and seconds.
fraction_of_second (decimal.Decimal) – fraction of second, which must be a value between 0.0 and 1.0.

Returns:

date and time value formatted as:: YYYY-MM-DD hh:mm:ss.######

Return type:

str

Raises:

ValueError – if the fraction of second is out of bounds.

class dfdatetime.precisions.PrecisionHelperFactory[source]

Bases: object

Date time precision helper factory.

classmethod CreatePrecisionHelper(precision)[source]

Creates a precision helper.

Parameters:: precision (str) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
Returns:: date time precision helper class.
Return type:: class
Raises:: ValueError – if the precision value is unsupported.

class dfdatetime.precisions.SecondsPrecisionHelper[source]

Bases: DateTimePrecisionHelper

Seconds precision helper.

classmethod CopyNanosecondsToFractionOfSecond(nanoseconds)[source]

Copies the number of nanoseconds to a fraction of second value.

Parameters:

nanoseconds (int) – number of nanoseconds.

Returns:

fraction of second, which must be a value between 0.0 and: 1.0. For the seconds precision helper this will always be 0.0.

Return type:

decimal.Decimal

Raises:

ValueError – if the number of nanoseconds is out of bounds.

classmethod CopyToDateTimeString(time_elements_tuple, fraction_of_second)[source]

Copies the time elements and fraction of second to a string.

Parameters:

time_elements_tuple (tuple[int, int, int, int, int, int]) – time elements, contains year, month, day of month, hours, minutes and seconds.
fraction_of_second (decimal.Decimal) – fraction of second, which must be a value between 0.0 and 1.0.

Returns:

date and time value formatted as:: YYYY-MM-DD hh:mm:ss

Return type:

str

Raises:

ValueError – if the fraction of second is out of bounds.

dfdatetime.rfc2579_date_time module

RFC2579 date-time implementation.

class dfdatetime.rfc2579_date_time.RFC2579DateTime(precision=None, rfc2579_date_time_tuple=None)[source]

Bases: DateTimeValues

RFC2579 date-time.

The RFC2579 date-time structure is 11 bytes of size and contains:

struct {: uin16_t year, uint8_t month, uint8_t day_of_month, uint8_t hours, uint8_t minutes, uint8_t seconds, uint8_t deciseconds, char direction_from_utc, uint8_t hours_from_utc, uint8_t minutes_from_utc

}

Also see:: https://datatracker.ietf.org/doc/html/rfc2579

year

year, 0 through 65536.

Type:: int

month

month of year, 1 through 12.

Type:: int

day_of_month

day of month, 1 through 31.

Type:: int

hours

hours, 0 through 23.

Type:: int

minutes

minutes, 0 through 59.

Type:: int

seconds

seconds, 0 through 59, where 60 is used to represent a leap-second.

Type:: int

deciseconds

deciseconds, 0 through 9.

Type:: int

CopyFromDateTimeString(time_string)[source]

Copies a RFC2579 date-time from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

Raises:

ValueError – if the date string is invalid or not supported.

CopyToDateTimeString()[source]

Copies the RFC2579 date-time to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss.#” or: None if the number of seconds is missing.

Return type:

str

__init__(precision=None, rfc2579_date_time_tuple=None)[source]

Initializes a RFC2579 date-time.

Parameters:

precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
rfc2579_date_time_tuple – (Optional[tuple[int, int, int, int, int, int, int, str, int, int]]): RFC2579 date-time time, contains year, month, day of month, hours, minutes, seconds and deciseconds, and time zone offset in hours and minutes from UTC.

Raises:

ValueError – if the system time is invalid.

property day_of_month

day of month or None if not set.

Type:: int

property deciseconds

number of deciseconds or None if not set.

Type:: int

property hours

number of hours or None if not set.

Type:: int

property minutes

number of minutes or None if not set.

Type:: int

property month

month or None if not set.

Type:: int

property seconds

number of seconds or None if not set.

Type:: int

property year

year or None if not set.

Type:: int

dfdatetime.semantic_time module

Semantic time implementation.

class dfdatetime.semantic_time.InvalidTime[source]

Bases: SemanticTime

Semantic time that represents invalid.

__init__()[source]: Initializes a semantic time that represents invalid.

class dfdatetime.semantic_time.Never[source]

Bases: SemanticTime

Semantic time that represents never.

__eq__(other)[source]

Determines if the date time values are equal to other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are equal to other.
Return type:: bool

__ge__(other)[source]

Determines if the date time values are greater than or equal to other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are greater than or equal to other.
Return type:: bool
Raises:: ValueError – if other is not an instance of DateTimeValues.

__gt__(other)[source]

Determines if the date time values are greater than other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are greater than other.
Return type:: bool
Raises:: ValueError – if other is not an instance of DateTimeValues.

__init__()[source]: Initializes a semantic time that represents never.

__le__(other)[source]

Determines if the date time values are less than or equal to other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are greater than or equal to other.
Return type:: bool
Raises:: ValueError – if other is not an instance of DateTimeValues.

__lt__(other)[source]

Determines if the date time values are less than other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are less than other.
Return type:: bool
Raises:: ValueError – if other is not an instance of DateTimeValues.

__ne__(other)[source]

Determines if the date time values are not equal to other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are not equal to other.
Return type:: bool

class dfdatetime.semantic_time.NotSet[source]

Bases: SemanticTime

Semantic time that represents not set.

__init__()[source]: Initializes a semantic time that represents not set.

class dfdatetime.semantic_time.SemanticTime(string=None)[source]

Bases: DateTimeValues

Semantic time.

Semantic time is term to describe date and time values that have specific meaning such as: “Never”, “Yesterday”, “Not set”.

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies semantic time from a date and time string.

Parameters:: time_string (str) – semantic representation of the time, such as: “Never”, “Not set”.
Raises:: ValueError – because semantic time cannot be copied from a string.

CopyToDateTimeString()[source]

Copies the date time value to a date and time string.

Returns:: semantic representation of the time, such as: “Never”, “Not set”.
Return type:: str

CopyToDateTimeStringISO8601()[source]

Copies the date time value to an ISO 8601 date and time string.

Returns:

date and time value formatted as an ISO 8601 date and time string,: which always be None since semantic time cannot be represented in ISO 8601.

Return type:

str

GetPlasoTimestamp()[source]

Retrieves a timestamp that is compatible with plaso.

Returns:: a POSIX timestamp in microseconds, which will always be 0.
Return type:: int

__eq__(other)[source]

Determines if the date time values are equal to other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are equal to other.
Return type:: bool

__ge__(other)[source]

Determines if the date time values are greater than or equal to other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are greater than or equal to other.
Return type:: bool
Raises:: ValueError – if other is not an instance of DateTimeValues.

__gt__(other)[source]

Determines if the date time values are greater than other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are greater than other.
Return type:: bool
Raises:: ValueError – if other is not an instance of DateTimeValues.

__init__(string=None)[source]

Initializes a semantic time.

Parameters:: string (str) – semantic representation of the time, such as: “Never”, “Not set”.

__le__(other)[source]

Determines if the date time values are greater than or equal to other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are greater than or equal to other.
Return type:: bool
Raises:: ValueError – if other is not an instance of DateTimeValues.

__lt__(other)[source]

Determines if the date time values are less than other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are less than other.
Return type:: bool
Raises:: ValueError – if other is not an instance of DateTimeValues.

__ne__(other)[source]

Determines if the date time values are not equal to other.

Parameters:: other (DateTimeValues) – date time values to compare against.
Returns:: True if the date time values are not equal to other.
Return type:: bool

property string

semantic representation of the time, such as: “Never”.

Type:: str

dfdatetime.serializer module

The date and time values serializer.

class dfdatetime.serializer.Serializer[source]

Bases: object

Date and time values serializer.

classmethod ConvertDateTimeValuesToDict(date_time_values)[source]

Converts a date and time values object into a JSON dictionary.

This method is deprecated use ConvertDateTimeValuesToJSON instead.

The resulting dictionary of the JSON serialized objects consists of: {

‘__type__’: ‘DateTimeValues’ ‘__class_name__’: ‘RFC2579DateTime’ …

}

Here ‘__type__’ indicates the object base type. In this case ‘DateTimeValues’. The rest of the elements of the dictionary make up the date and time value object properties.

Parameters:: date_time_values (dfdatetime.DateTimeValues) – date and time values.
Returns:: JSON serialized objects.
Return type:: dict[str, object]
Raises:: TypeError – if object is not an instance of DateTimeValues.

classmethod ConvertDateTimeValuesToJSON(date_time_values)[source]

Converts a date and time values object into a JSON dictionary.

The resulting dictionary of the JSON serialized objects consists of: {

‘__type__’: ‘DateTimeValues’ ‘__class_name__’: ‘RFC2579DateTime’ …

}

Here ‘__type__’ indicates the object base type. In this case ‘DateTimeValues’. The rest of the elements of the dictionary make up the date and time value object properties.

Parameters:: date_time_values (dfdatetime.DateTimeValues) – date and time values.
Returns:: JSON serialized objects.
Return type:: dict[str, object]

classmethod ConvertDictToDateTimeValues(json_dict)[source]

Converts a JSON dict into a date time values object.

This method is deprecated use ConvertJSONToDateTimeValues instead.

The dictionary of the JSON serialized objects consists of: {

‘__type__’: ‘DateTimeValues’ ‘__class_name__’: ‘RFC2579DateTime’ …

}

Here ‘__type__’ indicates the object base type. In this case this should be ‘DateTimeValues’. The rest of the elements of the dictionary make up the date time values object properties.

Parameters:: json_dict (dict[str, object]) – JSON serialized objects.
Returns:: date and time values.
Return type:: dfdatetime.DateTimeValues

classmethod ConvertJSONToDateTimeValues(json_dict)[source]

Converts a JSON dict into a date time values object.

The dictionary of the JSON serialized objects consists of: {

‘__type__’: ‘DateTimeValues’ ‘__class_name__’: ‘RFC2579DateTime’ …

}

Here ‘__type__’ indicates the object base type. In this case this should be ‘DateTimeValues’. The rest of the elements of the dictionary make up the date time values object properties.

Parameters:: json_dict (dict[str, object]) – JSON serialized objects.
Returns:: date and time values.
Return type:: dfdatetime.DateTimeValues

dfdatetime.systemtime module

SYSTEMTIME structure implementation.

class dfdatetime.systemtime.Systemtime(precision=None, system_time_tuple=None, time_zone_offset=None)[source]

Bases: DateTimeValues

SYSTEMTIME structure.

The SYSTEMTIME structure is 16 bytes of size and contains:

struct {: WORD year, WORD month, WORD day_of_week, WORD day_of_month, WORD hour, WORD minute, WORD second, WORD millisecond

}

CopyFromDateTimeString(time_string)[source]

Copies a SYSTEMTIME structure from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

Raises:

ValueError – if the date string is invalid or not supported.

CopyToDateTimeString()[source]

Copies the SYSTEMTIME structure to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss.###” or: None if the number of seconds is missing.

Return type:

str

__init__(precision=None, system_time_tuple=None, time_zone_offset=None)[source]

Initializes a SYSTEMTIME structure.

Parameters:

precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
system_time_tuple – (Optional[tuple[int, int, int, int, int, int, int, int]]): system time, contains year, month, day of week, day of month, hours, minutes, seconds and milliseconds.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.

Raises:

ValueError – if the system time is invalid.

property day_of_month

day of month, 1 through 31.

Type:: day_of_month (int)

property day_of_week

day of week, 0 through 6.

Type:: day_of_week (int)

property hours

hours, 0 through 23.

Type:: Hours (int)

property milliseconds

milliseconds, 0 through 999.

Type:: Milliseconds (int)

property minutes

minutes, 0 through 59.

Type:: Minutes (int)

property month

month of year, 1 through 12.

Type:: Month (int)

property seconds

seconds, 0 through 59.

Type:: Seconds (int)

property year

year, 1601 through 30827.

Type:: Year (int)

dfdatetime.time_elements module

Time elements implementation.

class dfdatetime.time_elements.TimeElements(is_delta=False, precision=None, time_elements_tuple=None, time_zone_offset=None)[source]

Bases: DateTimeValues

Time elements.

Time elements contain separate values for year, month, day of month, hours, minutes and seconds.

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies time elements from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

CopyFromDatetime(datetime_object)[source]

Copies time elements from a Python datetime object.

A naive datetime object is considered in local time.

Parameters:: datetime_object (datetime.datetime) – Python datetime object.

CopyFromStringISO8601(time_string)[source]

Copies time elements from an ISO 8601 date and time string.

Currently not supported: * Duration notation: “P…” * Week notation “2016-W33” * Date with week number notation “2016-W33-3” * Date without year notation “–08-17” * Ordinal date notation “2016-230”

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DDThh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

Raises:

ValueError – if the time string is invalid or not supported.

CopyFromStringRFC1123(time_string)[source]

Copies time elements from a RFC 1123 date and time string.

Parameters:

time_string (str) –

date and time value formatted as: DAY, D MONTH YYYY hh:mm:ss ZONE

Where weekday (DAY) and seconds (ss) are optional and day of month (D) can consist of 1 or 2 digits.

Raises:

ValueError – if the time string is invalid or not supported.

CopyFromStringRFC822(time_string)[source]

Copies time elements from a RFC 822 date and time string.

Parameters:

time_string (str) –

date and time value formatted as: DAY, D MONTH YY hh:mm:ss ZONE

Where weekday (DAY) and seconds (ss) are optional and day of month (D) can consist of 1 or 2 digits.

Raises:

ValueError – if the time string is invalid or not supported.

CopyFromStringTuple(time_elements_tuple)[source]

Copies time elements from string-based time elements tuple.

Parameters:: time_elements_tuple (Optional[tuple[str, str, str, str, str, str]]) – time elements, contains year, month, day of month, hours, minutes and seconds.
Raises:: ValueError – if the time elements tuple is invalid.

CopyToDateTimeString()[source]

Copies the time elements to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss” or None: if time elements are missing.

Return type:

str

NewFromDeltaAndDate(year, month, day_of_month)[source]

Creates a new time elements instance from a date time delta and a date.

Parameters:

year (int) – year.
month (int) – month, where 1 represents January and 0 if not set.
day_of_month (int) – day of month, where 1 represents the first day and 0 if not set.

Returns:

time elements or None if time elements are missing.

Return type:

TimeElements

Raises:

ValueError – if the instance is not a date time delta.

NewFromDeltaAndYear(year)[source]

Creates a new time elements instance from a date time delta and a year.

Parameters:: year (int) – year.
Returns:: time elements or None if time elements are missing.
Return type:: TimeElements
Raises:: ValueError – if the instance is not a date time delta.

__init__(is_delta=False, precision=None, time_elements_tuple=None, time_zone_offset=None)[source]

Initializes time elements.

Parameters:

is_delta (Optional[bool]) – True if the date and time value is relative to another date and time value.
precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_elements_tuple (Optional[tuple[int, int, int, int, int, int]]) – time elements, contains year, month, day of month, hours, minutes and seconds.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.

Raises:

ValueError – if the time elements tuple is invalid.

property day_of_month

day of month or None if not set.

Type:: int

property hours

number of hours or None if not set.

Type:: int

property minutes

number of minutes or None if not set.

Type:: int

property month

month or None if not set.

Type:: int

property seconds

number of seconds or None if not set.

Type:: int

property year

year or None if not set.

Type:: int

class dfdatetime.time_elements.TimeElementsInMicroseconds(is_delta=False, precision=None, time_elements_tuple=None, time_zone_offset=None)[source]

Bases: TimeElementsWithFractionOfSecond

Time elements in microseconds.

fraction_of_second

fraction of second, which must be a value between 0.0 and 1.0.

Type:: decimal.Decimal

is_local_time

True if the date and time value is in local time.

Type:: bool

precision

precision of the date of the date and time value, that represents 1 microsecond (PRECISION_1_MICROSECOND).

Type:: str

CopyFromStringTuple(time_elements_tuple)[source]

Copies time elements from string-based time elements tuple.

Parameters:: time_elements_tuple (Optional[tuple[str, str, str, str, str, str, str]]) – time elements, contains year, month, day of month, hours, minutes, seconds and microseconds.
Raises:: ValueError – if the time elements tuple is invalid.

NewFromDeltaAndDate(year, month, day_of_month)[source]

Creates a new time elements instance from a date time delta and a year.

Parameters:

year (int) – year.
month (int) – month, where 1 represents January and 0 if not set.
day_of_month (int) – day of month, where 1 represents the first day and 0 if not set.

Returns:

time elements or None if time elements are: missing.

Return type:

TimeElementsInMicroseconds

Raises:

ValueError – if the instance is not a date time delta.

NewFromDeltaAndYear(year)[source]

Creates a new time elements instance from a date time delta and a year.

Parameters:

year (int) – year.

Returns:

time elements or None if time elements are: missing.

Return type:

TimeElementsInMicroseconds

Raises:

ValueError – if the instance is not a date time delta.

__init__(is_delta=False, precision=None, time_elements_tuple=None, time_zone_offset=None)[source]

Initializes time elements.

Parameters:

is_delta (Optional[bool]) – True if the date and time value is relative to another date and time value.
precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_elements_tuple (Optional[tuple[int, int, int, int, int, int, int]]) – time elements, contains year, month, day of month, hours, minutes, seconds and microseconds.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.

Raises:

ValueError – if the time elements tuple is invalid.

property microseconds

number of microseconds.

Type:: int

class dfdatetime.time_elements.TimeElementsInMilliseconds(is_delta=False, precision=None, time_elements_tuple=None, time_zone_offset=None)[source]

Bases: TimeElementsWithFractionOfSecond

Time elements in milliseconds.

fraction_of_second

fraction of second, which must be a value between 0.0 and 1.0.

Type:: decimal.Decimal

is_local_time

True if the date and time value is in local time.

Type:: bool

precision

precision of the date of the date and time value, that represents 1 millisecond (PRECISION_1_MILLISECOND).

Type:: str

CopyFromStringTuple(time_elements_tuple)[source]

Copies time elements from string-based time elements tuple.

Parameters:: time_elements_tuple (Optional[tuple[str, str, str, str, str, str, str]]) – time elements, contains year, month, day of month, hours, minutes, seconds and milliseconds.
Raises:: ValueError – if the time elements tuple is invalid.

NewFromDeltaAndDate(year, month, day_of_month)[source]

Creates a new time elements instance from a date time delta and a date.

Parameters:

year (int) – year.
month (int) – month, where 1 represents January and 0 if not set.
day_of_month (int) – day of month, where 1 represents the first day and 0 if not set.

Returns:

time elements or None if time elements are: missing.

Return type:

TimeElementsInMilliseconds

Raises:

ValueError – if the instance is not a date time delta.

NewFromDeltaAndYear(year)[source]

Creates a new time elements instance from a date time delta and a year.

Parameters:

year (int) – year.

Returns:

time elements or None if time elements are: missing.

Return type:

TimeElementsInMilliseconds

Raises:

ValueError – if the instance is not a date time delta.

__init__(is_delta=False, precision=None, time_elements_tuple=None, time_zone_offset=None)[source]

Initializes time elements.

Parameters:

is_delta (Optional[bool]) – True if the date and time value is relative to another date and time value.
precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_elements_tuple (Optional[tuple[int, int, int, int, int, int, int]]) – time elements, contains year, month, day of month, hours, minutes, seconds and milliseconds.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.

Raises:

ValueError – if the time elements tuple is invalid.

property milliseconds

number of milliseconds.

Type:: int

class dfdatetime.time_elements.TimeElementsWithFractionOfSecond(fraction_of_second=None, is_delta=False, precision=None, time_elements_tuple=None, time_zone_offset=None)[source]

Bases: TimeElements

Time elements with a fraction of second interface.

fraction_of_second

fraction of second, which must be a value between 0.0 and 1.0.

Type:: decimal.Decimal

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDatetime(datetime_object)[source]

Copies time elements from a Python datetime object.

A naive datetime object is considered in local time.

Parameters:: datetime_object (datetime.datetime) – Python datetime object.

CopyFromStringTuple(time_elements_tuple)[source]

Copies time elements from string-based time elements tuple.

Parameters:: time_elements_tuple (Optional[tuple[str, str, str, str, str, str, str]]) – time elements, contains year, month, day of month, hours, minutes, seconds and fraction of seconds.
Raises:: ValueError – if the time elements tuple is invalid.

CopyToDateTimeString()[source]

Copies the time elements to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss” or: ”YYYY-MM-DD hh:mm:ss.######” or None if time elements are missing.

Return type:

str

Raises:

ValueError – if the precision value is unsupported.

NewFromDeltaAndDate(year, month, day_of_month)[source]

Creates a new time elements instance from a date time delta and a date.

Parameters:

year (int) – year.
month (int) – month, where 1 represents January and 0 if not set.
day_of_month (int) – day of month, where 1 represents the first day and 0 if not set.

Returns:

time elements or None if time elements: are missing.

Return type:

TimeElementsWithFractionOfSecond

Raises:

ValueError – if the instance is not a date time delta.

NewFromDeltaAndYear(year)[source]

Creates a new time elements instance from a date time delta and a year.

Parameters:

year (int) – year.

Returns:

time elements or None if time elements: are missing.

Return type:

TimeElementsWithFractionOfSecond

Raises:

ValueError – if the instance is not a date time delta.

__init__(fraction_of_second=None, is_delta=False, precision=None, time_elements_tuple=None, time_zone_offset=None)[source]

Initializes time elements.

Parameters:

fraction_of_second (Optional[decimal.Decimal]) – fraction of second, which must be a value between 0.0 and 1.0.
is_delta (Optional[bool]) – True if the date and time value is relative to another date and time value.
precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_elements_tuple (Optional[tuple[int, int, int, int, int, int]]) – time elements, contains year, month, day of month, hours, minutes and seconds.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.

Raises:

ValueError – if the time elements tuple is invalid or fraction of second value is out of bounds.

dfdatetime.uuid_time module

UUID version 1 time implementation.

class dfdatetime.uuid_time.UUIDTime(precision=None, time_zone_offset=None, timestamp=None)[source]

Bases: DateTimeValues

UUID version 1 timestamp.

The UUID version 1 timestamp is an unsigned 60-bit value that contains the number of 100th nano seconds intervals since 1582-10-15 00:00:00.

Also see:: https://en.wikipedia.org/wiki/Universally_unique_identifier

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies an UUID timestamp from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

Raises:

ValueError – if the time string is invalid or not supported.

CopyToDateTimeString()[source]

Copies the UUID timestamp to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss.#######” or: None if the timestamp is missing or invalid.

Return type:

str

__init__(precision=None, time_zone_offset=None, timestamp=None)[source]

Initializes an UUID version 1 timestamp.

Parameters:

precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.
timestamp (Optional[int]) – UUID version 1 timestamp.

Raises:

ValueError – if the UUID version 1 timestamp is invalid.

property timestamp

UUID timestamp or None if not set.

Type:: int

class dfdatetime.uuid_time.UUIDTimeEpoch[source]

Bases: DateTimeEpoch

UUID version 1 time epoch.

__init__()[source]: Initializes an UUID version 1 time epoch.

dfdatetime.webkit_time module

WebKit time implementation.

class dfdatetime.webkit_time.WebKitTime(precision=None, time_zone_offset=None, timestamp=None)[source]

Bases: DateTimeValues

WebKit timestamp.

The WebKit timestamp is a signed 64-bit integer that contains the number of microseconds since 1601-01-01 00:00:00.

is_local_time

True if the date and time value is in local time.

Type:: bool

CopyFromDateTimeString(time_string)[source]

Copies a WebKit timestamp from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

Raises:

ValueError – if the time string is invalid or not supported.

CopyToDateTimeString()[source]

Copies the WebKit timestamp to a date and time string.

Returns:

date and time value formatted as: “YYYY-MM-DD hh:mm:ss.######” or: None if the timestamp is missing or invalid.

Return type:

str

__init__(precision=None, time_zone_offset=None, timestamp=None)[source]

Initializes a WebKit timestamp.

Parameters:

precision (Optional[str]) – precision of the date and time value, which should be one of the PRECISION_VALUES in definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.
timestamp (Optional[int]) – WebKit timestamp.

property timestamp

WebKit timestamp or None if not set.

Type:: decimal.Decimal

class dfdatetime.webkit_time.WebKitTimeEpoch[source]

Bases: DateTimeEpoch

WebKit time epoch.

__init__()[source]: Initializes a WebKit time epoch.

Module contents

Digital Forensics Date and Time (dfDateTime).

dfDateTime, or Digital Forensics date and time, provides date and time objects to preserve accuracy and precision.