Timeline Construction and Event Reconstruction Questions

from datetime import datetime, timedelta, timezone

def filetime_to_iso(filetime):
    """
    Convert Windows FILETIME (int, 100-ns intervals since 1601-01-01) to ISO 8601 UTC string.
    Returns e.g. '2020-01-02T03:04:05Z' or None for zero/invalid input.
    """
    # Validate input
    if not isinstance(filetime, int) or filetime <= 0:
        return None

    # FILETIME epoch
    epoch_start = datetime(1601, 1, 1, tzinfo=timezone.utc)

    # Convert 100-ns intervals to microseconds (1 microsecond = 10 * 100-ns)
    try:
        micros = filetime // 10
        dt = epoch_start + timedelta(microseconds=micros)
    except (OverflowError, ValueError):
        return None

    # Ensure tz-aware UTC and format as ISO 8601 with 'Z'
    return dt.strftime('%Y-%m-%dT%H:%M:%SZ')

from datetime import datetime, timezone, timedelta

# Windows FILETIME epoch: 1601-01-01 UTC, units = 100-nanoseconds
_FILETIME_EPOCH = datetime(1601, 1, 1, tzinfo=timezone.utc)
_HUNDRED_NS = 10_000_000  # ticks per second

def parse_timestamp(s: str) -> datetime:
    s = s.strip()
    if not s:
        raise ValueError("Empty timestamp")

    # RFC3339 / ISO-8601 with offset (fast path)
    try:
        # fromisoformat parses offsets like +02:00 and Z (Python 3.11 supports 'Z'; else handle 'Z' below)
        if s.endswith("Z"):
            # convert trailing Z to +00:00 for compatibility on older Pythons
            dt = datetime.fromisoformat(s[:-1] + "+00:00")
        else:
            dt = datetime.fromisoformat(s)
        # ensure tz-aware and convert to UTC
        if dt.tzinfo is None:
            raise ValueError("Naive datetime in RFC input")
        return dt.astimezone(timezone.utc)
    except Exception:
        pass

    # Digit-only formats
    if s.lstrip("+-").isdigit():
        # normalize sign
        sign = 1
        if s[0] == "+":
            s_num = s[1:]
        elif s[0] == "-":
            sign = -1
            s_num = s[1:]
        else:
            s_num = s

        # choose by magnitude: epoch ms ~ 1.6e12 (current), filetime ~ 1.6e17
        n = int(s_num) * sign
        abs_n = abs(n)

        # heuristic thresholds
        if abs_n >= 1e14:  # likely FILETIME (hundreds of trillions)
            # FILETIME is number of 100-ns intervals since 1601-01-01 UTC
            # handle negative/zero safely
            seconds, remain100ns = divmod(n, _HUNDRED_NS)
            dt = _FILETIME_EPOCH + timedelta(seconds=seconds, microseconds=(remain100ns // 10))
            return dt.astimezone(timezone.utc)
        elif abs_n >= 1e11:  # likely epoch milliseconds (>= ~2001-09-09 -> 1e12; keep loose lower bound)
            # epoch milliseconds since 1970-01-01
            secs, ms = divmod(n, 1000)
            dt = datetime.fromtimestamp(secs, tz=timezone.utc).replace(microsecond=ms * 1000)
            return dt
        else:
            raise ValueError("Numeric timestamp too small/ambiguous")
    raise ValueError("Unrecognized timestamp format")

{
  "manifest_version": "1.0",
  "source": {"device_id":"IMG123","acquisition_time":"2026-02-01T10:00:00Z"},
  "raw_hash": "sha256:...",
  "steps": [
    {"step_id":1,"name":"ingest","tool":"dc3dd 7.0","output_hash":"sha256:..."},
    {"step_id":2,"name":"normalize","tool":"parserX 2.1","params":{"tz":"UTC"},"output_hash":"sha256:..."}
  ],
  "signature": {"alg":"ecdsa-p256","sig":"base64...","signer":"examiner@example"}
}