Bluetooth Connections

Overview

Evidence: Bluetooth Connections
Description: Collect Bluetooth Connections
Category: System
Platform: macos
Short Name: bluconn
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No

Background

KnowledgeC stores Bluetooth connection events with device names and MAC addresses. This data is essential for identifying connected peripherals and potential data exfiltration paths.

Data Collected

This collector gathers structured data about bluetooth connections.

Collection Method

This collector reads KnowledgeC databases and queries the bluetooth connection stream, recording into bluetooth_connections.

Forensic Value

This evidence is crucial for forensic investigations as it ties users to external devices and timestamps connections.