Windows Bluetooth Pairings
Windows records paired Bluetooth devices under HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Devices, preserving MAC and name after unpairing.
Where to find it
Default filesystem paths and registry locations. Collect these with your preferred live-response or disk-image tooling.
- $HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Devices\
Forensic significance
Common scenarios in which this artifact becomes decisive evidence.
- Identifying a suspect's personal phone via Bluetooth name
- Data exfiltration via Bluetooth file transfer
- Pairing suspect's headset to compromised workstation
MITRE ATT&CK mapping
Techniques this artifact can help detect or substantiate. Click a technique to view the official MITRE entry.
Tools that parse it
unJaena AI and other DFIR tools commonly used to extract evidence from this artifact.
Related artifacts
macOS Bluetooth plist
System Bluetooth configuration plist records paired devices with their MAC address, display name, device type, and last seen / last connected timestamps.
USB Device Connection History
Windows records every USB mass-storage device plugged in, keyed by vendor/product ID and serial number, with first- and last-connection timestamps.
Shell Bags
Windows Explorer view preferences recorded per-folder in UsrClass.dat. Shell Bags prove a user navigated to a folder, even after the folder or attached volume is long gone.
Amcache.hve
Compatibility database introduced in Windows 8 that records every PE file executed on the system, including SHA-1 hash, full path, publisher, and first-seen timestamp.
Stop parsing artifacts by hand
unJaena AI ingests disk images, live-response output, and mobile backups, then automatically correlates every artifact on this page — and 200+ more — into an investigator-ready timeline.
Try unJaena AI →