Forensic Analysis of Residual Bluetooth Artefacts in Android-Based Smartphones Before and After Device Unpairing

Bluetooth technology is the most popular method of wireless communications in mobile phones, wearables, and Internet of Things devices. Bluetooth makes device connectivity and information transfer easy, and thus Bluetooth-related information can be useful digital forensic evidence. Research looking into the persistence of Bluetooth artefacts in Android smartphones after devices are unpaired is lacking. This study was designed to look into possible residual Bluetooth artefacts persistence and assess their forensic importance. A controlled experiment using Android devices was designed for the inclusion of Bluetooth artefacts through the pairing, connecting, and transferring of files. This was followed by manual device unpairing by the experimenter. Afterwards, Android Debug Bridge (ADB) was used to perform a logical acquisition of the paired Android device and extract paired Bluetooth information along with Bluetooth device identifiers, Bluetooth device MAC addresses, connection information, file information, and system information. Persistence of Bluetooth artefacts in the system before and after the unpairing of Bluetooth devices was assessed through a comparative analysis. The results of the study showed that unpairing Bluetooth devices does remove the bonding information, but residual artefacts still exist in the system. Evidence of user activities that includes transferred files, file information, and device identifiers was found to remain after the unpairing of the Bluetooth device. The transferred files along with the file information retained user file timestamps and showed a complete absence of changes, and thus provided evidence that the unpairing of the Bluetooth device did not remove all information connected to Bluetooth. Forensic evidence was found to be still available even after the active pairing(s) of the Bluetooth devices had been removed. These results are significant for forensic studies because they show how Bluetooth artefacts help to show how devices were used, what other devices were paired to, and what communication may have taken place. One of the contributions of this study to mobile and digital forensics is the understanding that the unpairing of Bluetooth devices is, in fact, not the full removal of evidence, but only the partial removal of evidence. This shows that forensic investigators should focus on the unpairing of Bluetooth devices to evidence.