BLUETOOTH
The BLUETOOTH plugin retrieves and parses artifacts from com.apple.Bluetooth.plist.
This plugin supports standalone mode.
| macOS Version | Path |
|---|---|
| Lion, Mtn Lion, Mavericks, Yosemite, ElCap, Sierra, High Sierra | /Library/Preferences/com.apple.Bluetooth.plist |
$ python mac-apt.py -x -o ~/Case_Output E01 ~/Acquisition.E01 BLUETOOTH
| Field Name | Notes |
|---|---|
| Bluetooth Address | MAC Address of Bluetooth device |
| Name | Name of Bluetooth device |
| Display Name | Display Name of Bluetooth device (if applicable) |
| Manufacturer | Company ID of manufacturer |
| Battery Percent | Current battery percent of device (if applicable) |
| Connected | (Boolean) Whether or not the device is currently paired |
| Vendor ID | Vendor ID (VID) |
| Product ID | Product ID (PID) |
| Class of Device | Identifier of the classification of device |
| CoD_Device | Classification of device with subclass; Classes: Miscellaneous, Computer, Phone, LAN/Network Access Point, Audio/Video, Peripheral, Imaging, Wearable, Toy, Health |
| CoD_Service | Purpose/service provided by device |
| Last Name Update | Date/Time of last update to name |
| Services | ? |
| Supported Features | ? |
| Last Services Update | Date/Time of Last Service Update |
| Source | Source file from which the autostart information was retrieved |