Bluetooth Devices

Overview

Bluetooth pairing records establish proximity — they record which devices a Mac has been near enough to pair with, and when those connections last occurred. For investigations involving asset movement, social context, or insider activity, the Bluetooth artifact is a useful corroborating timeline.

Analysis Tips

• PairedDevices: Top-level key in com.apple.Bluetooth.plist listing every device the Mac has ever paired with — MAC, name, services, capabilities
• Device cache timestamps: Device cache entries can include LastInquiryUpdate, LastNameUpdate and LastServicesUpdate, which show when the Mac last saw or queried a device. The device cache is often absent on Apple Silicon Macs running macOS 11+
• Device class: macfor decodes the Class of Device value into major and minor classes (for example Audio/Video, Headphones) — useful for filtering noise
• Connection timeline: knowledgeC audio events and PowerLog connection records add timestamps that the plist alone does not provide
• AirDrop / Continuity: Bluetooth pairing underlies AirDrop and Handoff — paired iPhones often correlate with the same Apple ID's iCloud and Messages activity
• MAC randomisation: Modern devices may rotate BLE MACs — treat short-lived LE entries with caution

Related Artifacts

• Wi-Fi Networks - Wi-Fi joins paired with Bluetooth pairings build a strong location/movement timeline
• Pattern of Life - Knowledge of when the device was active corroborates Bluetooth event timing

References

• Apple Core Bluetooth documentation
• SANS macOS forensics — proximity artifacts