Bluetooth Connections

Overview

macOS maintains records of Bluetooth device pairings, connections, and device metadata. These artifacts reveal what peripherals, phones, and other devices have been paired with or connected to the Mac.

This article is under development. Detailed Bluetooth forensic analysis documentation is coming soon.

Key Forensic Areas

• Paired devices: All Bluetooth devices ever paired
• Device metadata: Device names, types, MAC addresses
• Connection timestamps: Last connection times
• Device types: Keyboards, mice, phones, headphones, etc.

File Locations

References

• SANS — macOS Bluetooth Forensics