iTerm2 History Timestamp to Human Readable

Question

I can see all commands entered into iTerm doing the following:

$ sqlite3 ~/Library/Application\ Support/iTerm2/ShellHistory.sqlite

sqlite>  select * from ZCOMMANDHISTORYCOMMANDUSE;

The output looks like this:

54171|1|1||22159|5120|642127758.695336|cat wolf_password|/Users/franks|6978AA30-BD92-4949-9C28-6B77F525DE51

The 7th column looks like a timestamp in milliseconds but it's not epoch, which would be: GMT: Tuesday, May 8, 1990 12:49:18.695 AM, which is incorrect, this command was run within the last couple of years.

Table schema shows:

sqlite> .schema ZCOMMANDHISTORYCOMMANDUSE
CREATE TABLE ZCOMMANDHISTORYCOMMANDUSE ( Z_PK INTEGER PRIMARY KEY, Z_ENT INTEGER, Z_OPT INTEGER, ZCODE INTEGER, ZENTRY INTEGER, Z_FOK_ENTRY INTEGER, ZTIME FLOAT, ZCOMMAND VARCHAR, ZDIRECTORY VARCHAR, ZMARKGUID VARCHAR );
CREATE INDEX ZCOMMANDHISTORYCOMMANDUSE_ZENTRY_INDEX ON ZCOMMANDHISTORYCOMMANDUSE (ZENTRY);

It's ZTIME FLOAT

Given the above, what human-readable date and time is 642127758.695336

Answer 1

Your command executed on May 8 2021 at 00:49:18 UTC.

If we take a look at the iTerm2 source code for history storage, we notice that that now is defined as the following:

- (NSTimeInterval)now {
    return [NSDate timeIntervalSinceReferenceDate];
}

If we then take a look at the NSDate documentation for timeIntervalSinceReferenceDate, we notice that Apple uses a different epoch than UNIX. Any time based on this property will calculate seconds from January 1 2000 at 00:00 UTC.