Bluetooth
Scenario
You were doing work on your laptop while staying at an Airport hotel. A notification regarding Bluetooth popped up and you assumed it was just your new Bluetooth Headphones. The next morning you realize you attempt to connect your Bluetooth headphones and realize that the name was different than the notification you got last night and you want to check what Bluetooth devices have been connected to your MacBook.
/var/log/wifi.log
“This file holds results about different wireless details. If you're in search of whether or not the user was on the company network at the time of compromise this would be a good place to start. This file includes more than just wireless internet results. It also includes information on other wireless connections such as Bluetooth.”
Copy and Paste this into the terminal;
plutil -p /Library/Preferences/com.apple.Bluetooth.plist
Here you will be able identify the Name of any devices that are connected or have been connected to the computer in the past. You can identify whether the device was the incoming or outgoing port by where the device information is listed. In this scenario the device was the host connecting to the computer so you can see the information listed under “outgoing port”.
You can find device information as well as timestamp information under the “DeviceCache” section.
You were doing work on your laptop while staying at an Airport hotel. A notification regarding Bluetooth popped up and you assumed it was just your new Bluetooth Headphones. The next morning you realize you attempt to connect your Bluetooth headphones and realize that the name was different than the notification you got last night and you want to check what Bluetooth devices have been connected to your MacBook.
/var/log/wifi.log
“This file holds results about different wireless details. If you're in search of whether or not the user was on the company network at the time of compromise this would be a good place to start. This file includes more than just wireless internet results. It also includes information on other wireless connections such as Bluetooth.”
Copy and Paste this into the terminal;
plutil -p /Library/Preferences/com.apple.Bluetooth.plist
Here you will be able identify the Name of any devices that are connected or have been connected to the computer in the past. You can identify whether the device was the incoming or outgoing port by where the device information is listed. In this scenario the device was the host connecting to the computer so you can see the information listed under “outgoing port”.
You can find device information as well as timestamp information under the “DeviceCache” section.