Now, using the original query that we have been building upon, add in the correct conversions for both columns that contain timestamps.

SELECT

ZUSER AS "User",

ZTIMESTAMP AS “Timestamp”,

datetime(ZTIMESTAMP+ 978307200,'unixepoch','localtime') AS "Timestamp",

ZBODY AS "Message",

ZRECEIVEDTIMESTAMP AS “Message Received”

datetime(ZRECEIVEDTIMESTAMP+ 978307200,'unixepoch','localtime') AS "Message Received"

FROM ZKIKMESSAGE

The result of applying the Mac Absolute time conversion should be legible timestamps.

Each timestamp conversion will ALWAYS begin with datetime.

Immediately following this syntax, you will reference the ORIGINAL column name that contains the timestamp (e.g., ZTIMESTAMP and ZRECEIVEDTIMESTAMP in the above example).