Bluetooth

Artifact: Bluetooth Other LE

• Database location and name: /private/var/containers/Shared/SystemGroup/GUID/Library/Database/com.apple.MobileBluetooth.ledevices.other.db
• Explanation: Artifact documents the detection of low energy Bluetooth devices. It includes devices that came in range from the target iOS device. It includes devices that have “sleep mode” and operate in a different band than normal Bluetooth.
• Screenshot

Artifact: Bluetooth Paired LE

• Database location and name: /private/var/containers/Shared/SystemGroup/GUID/Library/Database/com.apple.MobileBluetooth.ledevices.paired.db
• Explanation: Artifact documents low energy Bluetooth devices that have been paired with the target iOS device.
• Screenshot:

Artifact: Bluetooth Paired

• Database location and name: /private/var/containers/Shared/SystemGroup/GUID/Library/Database/com.apple.MobileBluetooth.devices.plist
• Explanation: Artifact documents Bluetooth devices that have been paired with the target iOS device.
• Screenshot:

Online references:

• https://www.cellebrite.com/en/blog/how-to-use-ios-bluetooth-connections-to-solve-crimes-faster/