Bluetooth Paired Device Records (com.apple.MobileBluetooth.devices.plist)

Location

Description

Property list file containing records of all Bluetooth devices that have been paired with the iOS device. Each entry is keyed by the Bluetooth MAC address and contains the device name, device type, manufacturer, last connection timestamp, and pairing metadata. Covers both Bluetooth Classic and Bluetooth Low Energy (BLE) devices.

Forensic Value

Bluetooth pairing records establish physical proximity between the iOS device and other Bluetooth devices, as pairing requires close physical range. The device names and MAC addresses can be matched against known devices to identify accessories, vehicles, computers, and other phones that were in proximity. Last connection timestamps reveal when devices were most recently used together. Unexpected paired devices may indicate unauthorized physical access or data transfer via Bluetooth. Vehicle Bluetooth pairings establish that the device was present in a specific vehicle. The presence of paired fitness trackers, smartwatches, or medical devices may lead to additional forensic data sources.

Tools Required

Collection Commands

idevicebackup2 backup --full /forensics/ios_backup/

python3 ileapp.py -t tar -i /path/to/backup -o /forensics/output/

ideviceinfo -u <UDID> -q com.apple.mobile.bluetooth > bluetooth_info.txt

Collection Constraints

• •Availability depends on iOS version, device lock state, backup class, and extraction method. Many protected domains require a full filesystem extraction or sysdiagnose rather than a standard backup.
• •Mobile application data may be partially cached, excluded from backup, or pruned by the OS. Validate against the extraction type before treating gaps as meaningful.

MITRE ATT&CK Techniques

References