Introducing Bluetooth forensics

Using Bluetooth technology, users can transfer data between different devices and attach headphones, speakers, or any kind of wireless device to their smartphone. Typically, iOS devices operate as Class 2 Bluetooth devices, which means they can operate at a range of approximately 10 meters (33 feet).

From a forensic viewpoint, iOS devices maintain the following:

• A list of low-energy Bluetooth devices that can connect to the user's device, also called paired devices. These are stored in the /private/var/containers/Shared/SystemGroup/<GUID>/Library/Database/com.apple.MobileBluetooth.ledevices.paired.db database, under the PairedDevices table. This table maintains a list of devices, their names, their Media Access Control (MAC) addresses, and their last-seen timestamps.
• Other Bluetooth paired devices (not just low-energy), which are stored in the /private/var/containers/Shared/SystemGroup/<GUID>/Library/Preferences/com.apple...