Glossary
Mac Absolute Time
Mac Absolute Time (Cocoa Core Data time) counts seconds since 2001-01-01 00:00:00 UTC; add 978307200 to convert it to a Unix timestamp.
Mac Absolute Time, also called Cocoa or Core Data timestamp, counts seconds since 2001-01-01 00:00:00 UTC. It is used throughout macOS artifacts, including knowledgeC.db, Safari's History.db, and the QuarantineEventsV2 database. Values are often stored as floating-point numbers with fractional seconds.
To convert to Unix time, add 978307200, the number of seconds between 1970-01-01 and 2001-01-01. In SQLite:
SELECT datetime(ZSTARTDATE + 978307200, 'unixepoch') FROM ZOBJECT;
Do not confuse it with other epochs found on a Mac: Unix (1970), HFS+ (1904), or WebKit/Chrome time (microseconds since 1601). See APFS snapshots and timestamps for an epoch comparison table.