Skip to content
AndroidForensics

NetworkLocation

Bluetooth on Android: bt_config.conf and Logs

Android Bluetooth evidence: paired devices in bt_config.conf with names, classes and pairing times, dumpsys bluetooth_manager and HCI snoop logs.

Location
/data/misc/bluedroid/bt_config.conf (+ bt_config.bak); some recent builds use /data/misc/bluetooth/
Android
Proves
Which Bluetooth devices were paired (car head units, headsets, watches, trackers, computers), their names, addresses and device classes, when each was paired, and the phone's own Bluetooth name and address
Timestamps
Per-device Timestamp in Unix seconds (pairing or bonding time on AOSP); dumpsys bluetooth_manager prints enable and disable events in local time; HCI snoop logs carry per-packet times
Access
Full file system (root, exploit or agent): /data/misc is device-encrypted, so BFU readable by a privileged extraction. Logical and bugreport: dumpsys bluetooth_manager lists bonded devices and recent activity. Not in ADB backup.
Retention
A paired device stays until it is unpaired or Bluetooth data is reset; the enable and disable log is short and in memory; HCI snoop logs exist only when the developer option was on
Collection
Full file system extraction, adb shell dumpsys bluetooth_manager, adb bugreport

Tools

Compare all tools

What it is

The Android Bluetooth stack (Bluedroid, later Fluoride and Gabeldorsche) stores its persistent configuration in an INI-style text file, bt_config.conf. It holds one section for the phone's own adapter and one section per bonded (paired) device, with the remote device's name, address, class, supported profiles, link keys and a pairing timestamp.

For investigators the interesting devices are the ones that tie a phone to a place or another person: a car's head unit ("MyCar", "SYNC", "Uconnect"), a smartwatch, a partner's headphones, a laptop, a tracking tag. A pairing time shows the first association; bugreport data can add recent connections.

Where it lives

ItemPathNotes
Configuration/data/misc/bluedroid/bt_config.confCurrent file
Backup copy/data/misc/bluedroid/bt_config.bakPrevious version, sometimes with older entries
Recent builds/data/misc/bluetooth/Some Android 13+ builds keep config and logs here: search for bt_config.*
HCI snoop log/data/misc/bluetooth/logs/btsnoop_hci.logOnly if Enable Bluetooth HCI snoop log was on in Developer options
Live statedumpsys bluetooth_managerBonded devices, adapter state, enable and disable history

Samsung and other OEMs keep the same file, sometimes with extra keys; verify on your build.

What it proves

  • The phone's Bluetooth name and MAC address ([Adapter] section).
  • Every bonded device: MAC address, advertised name, device class (phone, audio, car audio, wearable, computer), device type (classic, LE, dual) and service UUIDs (hands-free, A2DP, HID).
  • When each device was paired (Timestamp).
  • Link keys proving a bond exists (sensitive: they allow impersonation; restrict access).

It does not prove every connection; a paired car shows association, and connection times come from dumpsys, logs or the car itself.

Key fields

KeyMeaning
[Adapter] Address, NameThe phone's Bluetooth identity
[aa:bb:cc:dd:ee:ff]Section per remote device
NameRemote device's advertised name
DevClassClass of Device (decimal) encoding major and minor class
DevType1 classic (BR/EDR), 2 LE, 3 dual
TimestampUnix seconds, pairing time on AOSP
ServiceUUIDs of supported profiles
LinkKey, LE_KEY_*Bond keys
ManufacturerChipset vendor ID

Timestamps

Timestamp is Unix seconds in UTC. Convert it and compare with other sources; OEM builds have been reported to update it on events other than first pairing, so treat it as "at or after the bond" unless validated on a test phone.

grep -E '^\[|^Name|^DevClass|^Timestamp' bt_config.conf
# Convert one value
date -u -r 1789400592      # macOS; GNU: date -u -d @1789400592
adb shell dumpsys bluetooth_manager > dumpsys_bluetooth.txt

Retention

Bonds persist across reboots and OS updates until the user unpairs the device or resets network settings. The .bak copy may keep a device removed recently. The dumpsys enable and disable history is short and lost at reboot. HCI snoop logs roll over at a size limit.

Collection

  • Full file system extraction: bt_config.conf, bt_config.bak and any logs under /data/misc/bluetooth/. Available in BFU.
  • Logical: adb shell dumpsys bluetooth_manager gives bonded devices and recent adapter activity without root.
  • Bugreport: includes the Bluetooth dump and, when snoop logging was enabled, sometimes the snoop log.

Parsing

  • ALEAPP parses bt_config.conf into a device list.
  • Wireshark opens btsnoop_hci.log to show connections and profiles at packet level.
  • Commercial suites list paired devices in their connectivity section.

Investigator tips

  • A car head unit bond plus Google Maps Timeline driving segments makes a strong travel narrative; the car's infotainment system may hold the matching record and the phone's contacts.
  • Compare with WifiConfigStore.xml: a watch or car often shares a location story with a network joined the same day.
  • Bluetooth-related states in batterystats history (such as BLE scans) show when the radio was busy in the last hours; token names vary by release.
  • The location forensics guide explains how to use associations without over-reading them.

See also