Pro plugin

Bluetooth Devices

Collects Bluetooth device pairing history, connection events, radio state, and audio session data from macOS system plists, KnowledgeC, and PowerLog

devices.bluetoothPromacOS 10.15+v1.0.0devicessystemconnectivity

Run this plugin

Trigger collection for Bluetooth Devices on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin devices.bluetooth --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin devices.bluetooth --dry-run

Compatibility

macOS 10.15+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (6 collected)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

config

Artifact	Format	Path	Notes
Bluetooth Device Cache bluetooth_devicehigh value	binary_plist	`/Library/Preferences/com.apple.Bluetooth.plist`	System-level Bluetooth plist containing paired devices, MAC addresses, device names, Class of Device, and last connection timestamps.
Bluetooth System Configuration bluetooth_system_configmedium value	binary_plist	`/Library/Preferences/com.apple.Bluetooth.plist`	Controller firmware version, Bluetooth address, discovery state, and global settings.
Bluetooth ByHost Preferences bluetooth_byhost_preferencesmedium value	binary_plist	`~/Library/Preferences/ByHost/com.apple.Bluetooth.*.plist`	Per-user Bluetooth preferences keyed by hardware UUID. Contains user-specific device settings.

history

Artifact	Format	Path	Notes
Bluetooth Audio Connections bluetooth_audio_connectionhigh value	sqlite	`~/Library/Application Support/Knowledge/knowledgeC.db` +1 more `/private/var/db/CoreDuet/Knowledge/knowledgeC.db`	KnowledgeC records of Bluetooth audio routing events with device identifiers and timestamps.
Bluetooth Radio State bluetooth_radio_statehigh value	sqlite	`/private/var/db/powerlog/CurrentPowerlog.PLSQL`	PowerLog records of Bluetooth radio state changes (on/off/discoverable) with timestamps.
Bluetooth Paired Device Configuration bluetooth_paired_device_confighigh value	sqlite	`/private/var/db/powerlog/CurrentPowerlog.PLSQL`	PowerLog records of Bluetooth paired device connection and disconnection events.