Bluetooth technology is the most popular method of wireless communications in mobile phones, wearables, and Internet of Things devices. Bluetooth makes device connectivity and information transfer easy, and thus Bluetooth-related information can be useful digital forensic evidence. Research looking into the persistence of Bluetooth artefacts in Android smartphones after devices are unpaired is lacking. This study was designed to look into possible residual Bluetooth artefacts persistence and assess their forensic importance. A controlled experiment using Android devices was designed for the inclusion of Bluetooth artefacts through the pairing, connecting, and transferring of files. This was followed by manual device unpairing by the experimenter. Afterwards, Android Debug Bridge (ADB) was used to perform a logical acquisition of the paired Android device and extract paired Bluetooth information along with Bluetooth device identifiers, Bluetooth device MAC addresses, connection information, file information, and system information. Persistence of Bluetooth artefacts in the system before and after the unpairing of Bluetooth devices was assessed through a comparative analysis. The results of the study showed that unpairing Bluetooth devices does remove the bonding information, but residual artefacts still exist in the system. Evidence of user activities that includes transferred files, file information, and device identifiers was found to remain after the unpairing of the Bluetooth device. The transferred files along with the file information retained user file timestamps and showed a complete absence of changes, and thus provided evidence that the unpairing of the Bluetooth device did not remove all information connected to Bluetooth. Forensic evidence was found to be still available even after the active pairing(s) of the Bluetooth devices had been removed. These results are significant for forensic studies because they show how Bluetooth artefacts help to show how devices were used, what other devices were paired to, and what communication may have taken place. One of the contributions of this study to mobile and digital forensics is the understanding that the unpairing of Bluetooth devices is, in fact, not the full removal of evidence, but only the partial removal of evidence. This shows that forensic investigators should focus on the unpairing of Bluetooth devices to evidence.
| Published in | Science Discovery Computers (Volume 1, Issue 1) |
| DOI | 10.11648/j.sdcomput.20260101.14 |
| Page(s) | 32-39 |
| Creative Commons |
This is an Open Access article, distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution and reproduction in any medium or format, provided the original work is properly cited. |
| Copyright |
Copyright © The Author(s), 2026. Published by Science Publishing Group |
Bluetooth Forensics, Android Smartphones, Digital Forensics, Bluetooth Artefacts, Device Unpairing, Mobile Forensics
| [1] | Neyaz, A., Shashidhar, N. USB artifact analysis using windows event viewer, registry and file system logs. Electronics (Switzerland). 2019, 8(11). |
| [2] | Anathi, M., Vijayakumar, K. An intelligent approach for dynamic network traffic restriction using MAC address verification. Comput. Commun. 2020, 154, 559-564. |
| [3] | Teing, Y. Y., Dehghantanha, A., Choo, K. K. R., Dargahi, T., Conti, M. Forensic Investigation of Cooperative Storage Cloud Service: Symform as a Case Study. J. Forensic Sci. 2017, 62(3), 641-654. |
| [4] | Ahmed, A. A., Farhan, K., Ninggal, M. I. H., Alselwi, G. Retrieving and Identifying Remnants of Artefacts on Local Devices Using Sync.com Cloud. Sensors. 2025, 25(1). |
| [5] |
OWASP Top 10 - OWASP Developer Guide. Available from:
https://devguide.owasp.org/en/02-foundations/05-top-ten/ (accessed 10 April 2026). |
| [6] | Gomez, C., Oller, J., Paradells, J. Overview and evaluation of bluetooth low energy: An emerging low-power wireless technology. Sensors (Switzerland). 2012, 12(9), 11734-11753. |
| [7] | Naik, A. G., Kuwelkar, S., Magdum, V. Energy and Current Consumption Analysis for Classic Bluetooth and Bluetooth Low Energy (BLE). Emerging Research in Computing, Information, Communication and Applications: ERCICA 2015. 2015, 87-95. |
| [8] | Natgunanathan, I., Fernando, N., Loke, S. W., Weerasuriya, C. Bluetooth Low Energy Mesh: Applications, Considerations and Current State-of-the-Art. Sensors. 2023, 23(4). |
| [9] | García-Ortiz, J. C., Silvestre-Blanes, J., Sempere-Payá, V. Experimental application of bluetooth low energy connectionless in smart cities. Electronics (Switzerland). 2021, 10(22). |
| [10] | Murugalakshmi, S. Evolution and performance analysis of bluetooth low energy 5.0. i-manager’s Journal on Mobile Applications and Technologies. 2023, 10(2), 31. |
| [11] | Yang, J., Poellabauer, C., Mitra, P., Neubecker, C. Beyond beaconing: Emerging applications and challenges of BLE. Ad Hoc Networks. 2020, 97. |
| [12] | Raj, U. Bluetooth Low Energy: A Comprehensive Wireless Technology. International Journal of Advance Research and Innovation. 2021, 9(3), 64-69. |
| [13] | Liu, C., Zhang, Y., Zhou, H. A comprehensive study of bluetooth low energy. J. Phys. Conf. Ser. 2021, 2093(1). |
| [14] | Hoddie, P., Prader, L. Bluetooth Low Energy (BLE). IoT Development for ESP32 and ESP8266 with JavaScript. 2020, 185-220. |
APA Style
Drashti, D., Joshi, K., Kumar, K. (2026). Forensic Analysis of Residual Bluetooth Artefacts in Android-Based Smartphones Before and After Device Unpairing. Science Discovery Computers, 1(1), 32-39. https://doi.org/10.11648/j.sdcomput.20260101.14
ACS Style
Drashti, D.; Joshi, K.; Kumar, K. Forensic Analysis of Residual Bluetooth Artefacts in Android-Based Smartphones Before and After Device Unpairing. Sci. Discov. Comput. 2026, 1(1), 32-39. doi: 10.11648/j.sdcomput.20260101.14
AMA Style
Drashti D, Joshi K, Kumar K. Forensic Analysis of Residual Bluetooth Artefacts in Android-Based Smartphones Before and After Device Unpairing. Sci Discov Comput. 2026;1(1):32-39. doi: 10.11648/j.sdcomput.20260101.14
Share This Article
Twitter
Linked In
Facebook
Copy
Download@article{10.11648/j.sdcomput.20260101.14,
author = {Dave Drashti and Kashyap Joshi and Kapil Kumar},
title = {Forensic Analysis of Residual Bluetooth Artefacts in Android-Based Smartphones Before and After Device Unpairing},
journal = {Science Discovery Computers},
volume = {1},
number = {1},
pages = {32-39},
doi = {10.11648/j.sdcomput.20260101.14},
url = {https://doi.org/10.11648/j.sdcomput.20260101.14},
eprint = {https://article.sciencepublishinggroup.com/pdf/10.11648.j.sdcomput.20260101.14},
abstract = {Bluetooth technology is the most popular method of wireless communications in mobile phones, wearables, and Internet of Things devices. Bluetooth makes device connectivity and information transfer easy, and thus Bluetooth-related information can be useful digital forensic evidence. Research looking into the persistence of Bluetooth artefacts in Android smartphones after devices are unpaired is lacking. This study was designed to look into possible residual Bluetooth artefacts persistence and assess their forensic importance. A controlled experiment using Android devices was designed for the inclusion of Bluetooth artefacts through the pairing, connecting, and transferring of files. This was followed by manual device unpairing by the experimenter. Afterwards, Android Debug Bridge (ADB) was used to perform a logical acquisition of the paired Android device and extract paired Bluetooth information along with Bluetooth device identifiers, Bluetooth device MAC addresses, connection information, file information, and system information. Persistence of Bluetooth artefacts in the system before and after the unpairing of Bluetooth devices was assessed through a comparative analysis. The results of the study showed that unpairing Bluetooth devices does remove the bonding information, but residual artefacts still exist in the system. Evidence of user activities that includes transferred files, file information, and device identifiers was found to remain after the unpairing of the Bluetooth device. The transferred files along with the file information retained user file timestamps and showed a complete absence of changes, and thus provided evidence that the unpairing of the Bluetooth device did not remove all information connected to Bluetooth. Forensic evidence was found to be still available even after the active pairing(s) of the Bluetooth devices had been removed. These results are significant for forensic studies because they show how Bluetooth artefacts help to show how devices were used, what other devices were paired to, and what communication may have taken place. One of the contributions of this study to mobile and digital forensics is the understanding that the unpairing of Bluetooth devices is, in fact, not the full removal of evidence, but only the partial removal of evidence. This shows that forensic investigators should focus on the unpairing of Bluetooth devices to evidence.},
year = {2026}
}
TY - JOUR T1 - Forensic Analysis of Residual Bluetooth Artefacts in Android-Based Smartphones Before and After Device Unpairing AU - Dave Drashti AU - Kashyap Joshi AU - Kapil Kumar Y1 - 2026/09/29 PY - 2026 N1 - https://doi.org/10.11648/j.sdcomput.20260101.14 DO - 10.11648/j.sdcomput.20260101.14 T2 - Science Discovery Computers JF - Science Discovery Computers JO - Science Discovery Computers SP - 32 EP - 39 PB - Science Publishing Group UR - https://doi.org/10.11648/j.sdcomput.20260101.14 AB - Bluetooth technology is the most popular method of wireless communications in mobile phones, wearables, and Internet of Things devices. Bluetooth makes device connectivity and information transfer easy, and thus Bluetooth-related information can be useful digital forensic evidence. Research looking into the persistence of Bluetooth artefacts in Android smartphones after devices are unpaired is lacking. This study was designed to look into possible residual Bluetooth artefacts persistence and assess their forensic importance. A controlled experiment using Android devices was designed for the inclusion of Bluetooth artefacts through the pairing, connecting, and transferring of files. This was followed by manual device unpairing by the experimenter. Afterwards, Android Debug Bridge (ADB) was used to perform a logical acquisition of the paired Android device and extract paired Bluetooth information along with Bluetooth device identifiers, Bluetooth device MAC addresses, connection information, file information, and system information. Persistence of Bluetooth artefacts in the system before and after the unpairing of Bluetooth devices was assessed through a comparative analysis. The results of the study showed that unpairing Bluetooth devices does remove the bonding information, but residual artefacts still exist in the system. Evidence of user activities that includes transferred files, file information, and device identifiers was found to remain after the unpairing of the Bluetooth device. The transferred files along with the file information retained user file timestamps and showed a complete absence of changes, and thus provided evidence that the unpairing of the Bluetooth device did not remove all information connected to Bluetooth. Forensic evidence was found to be still available even after the active pairing(s) of the Bluetooth devices had been removed. These results are significant for forensic studies because they show how Bluetooth artefacts help to show how devices were used, what other devices were paired to, and what communication may have taken place. One of the contributions of this study to mobile and digital forensics is the understanding that the unpairing of Bluetooth devices is, in fact, not the full removal of evidence, but only the partial removal of evidence. This shows that forensic investigators should focus on the unpairing of Bluetooth devices to evidence. VL - 1 IS - 1 ER -
Department of Biochemistry & Forensic Science, Gujarat University, Ahmedabad, India
Department of Biochemistry & Forensic Science, Gujarat University, Ahmedabad, India
Department of Biochemistry & Forensic Science, Gujarat University, Ahmedabad, India
Information