timesync

Records in /private/var/db/diagnostics/timesync that convert Unified Log Mach times into wall-clock UTC for each boot.

Unified Log entries carry Mach continuous time, which counts from boot. The .timesync files in /private/var/db/diagnostics/timesync pair, per boot UUID, continuous-time values with wall-clock times and record the timebase. A parser finds the nearest preceding record for an entry and adds the elapsed time to get UTC.

Without timesync files, times can only be approximated. See the tracev3 format explained.