It may not always be apparent by simply looking at the timestamps, but by using the process of elimination, it is usually easy to apply the correct timestamp conversion to the database.

Below is a list of possible query strings to convert the timestamp:

1) datetime(ZTIMESTAMP, ‘unixepoch’,'localtime') AS "Timestamp"

2) datetime(ZTIMESTAMP/1000,’unixepoch','localtime') AS "Timestamp"

3) datetime(ZTIMESTAMP+ 978307200,'unixepoch','localtime') AS "Timestamp“

4) datetime(ZTIMESTAMP+ (strftime('%s','1601-01-01')),’unixepoch’,'localtime') AS “Timestamp”

By process of elimination, we can likely eliminate option 1 because the field contains more than 10 digits and option 2 because the field also doesn’t contain 13 digits. This leaves option 3, the conversion for Mac Absolute time. If you remembered that we have been utilizing the kik.sqlite database from an iOS device, this would also be another way to narrow down the correct timestamp query.