Bluetooth Paired Devices (bt_config.conf)

Location

Description

Configuration file storing Bluetooth adapter settings and a record of all paired devices. Each paired device entry includes the device Bluetooth MAC address, device name, device class (indicating device type such as phone, headset, computer, or car), pairing timestamp, link key, and supported Bluetooth profiles (A2DP, HFP, HID, etc.).

Forensic Value

Bluetooth pairing records establish associations between the investigated device and other specific devices, potentially linking the device user to vehicles (hands-free pairing), other phones (file transfer), computers (tethering), wearables (fitness trackers, smartwatches), and IoT devices. Device names often contain identifiable information such as the owner name (e.g., "John's AirPods"). The device class field identifies the type of paired device even when the name is generic. Pairing timestamps establish when the association was created. These records persist after the paired device is no longer in range and survive factory resets in some cases.

Tools Required