4

I have a rooted samsung Galaxy grand 4.1.2 with full file access, That has a paired bluetooth connection with another phone. Is there any simple way/app (non programmer) to see the actual date the original pairing request was made. I need to find it out exactly for a legal issue and am struggling to find out if its possible. thanks

saitek
  • 49
  • 1
  • 1
  • 3
  • You may have to do some work here. I believe that there cannot be a single way to achieve the goal. If I happened to have this issue, I would do this: setup busybox in Android, setup [tag:adb] in PC, pair a device with yours and after pairing immediately execute the command adb shell su -c 'busybox find /data/ -mmin -2'. Make an educated guess in the output and go through all the listed locations. You may be able to get the answer. E.g. In my Android 5.0.2, that technique listed out /data/misc/bluedroid/bt_config.old which did contain the timestamp. – Firelord Feb 27 '16 at 12:40
  • thank you, using es file explorer in /data/misc/bluedroid/bt_config.old i can see order of connection and timestamp value of /N1 but i cant make out how to read it? <N1 Tag ="Timestamp" (next line) Type="int">1399293673 p.s i wouldnt have a clue how to execute a shell command! – saitek Feb 27 '16 at 13:09
  • That numeric string (1399293673) is Unix Time. Convert it here: http://www.epochconverter.com/ Also, I didn't verify much so you may also peek into the file bt_config.xml. – Firelord Feb 27 '16 at 22:48
  • @Firelord can you maybe put that as an answer with some command usage and sample output since my answer was a little flaky (device dependant)? – Aaron Gillion Feb 27 '16 at 22:51
  • @AaronGillion Mine is also device dependent since it doesn't work on my Android 4.2.1 (an MTK device). I'll try to post my answer after a bit of testing. – Firelord Feb 27 '16 at 22:54

1 Answers1

-1

The database you're looking for is /data/data/com.android.bluetooth/databases/btopp.db

The full history should be there until you explicitly clear data in Application Manager.

I remember reading a full guide on a digital forensics site, can't find the link I had in mind, but this one tells us the log includes MAC addresses (good for legal evidence):

http://www.forensicfocus.com/Forums/viewtopic/t=11733/

Hope this steers you in the right direction.

Aaron Gillion
  • 1,564
  • 3
  • 13
  • 21
  • On which Android version and device is this answer tested on? My Android 4.2.1 (on an MTK device) doesn't have com.android.bluetooth but my Android 4.4.2 (MTK device) and CM builds have. The link you noted has posts from 2014. – Firelord Feb 27 '16 at 11:48
  • I now tried a fresh pairing between my Android 4.4.2 and 5.0.2. That database doesn't seem to list anything about connections but only file transfers. Please provide a proof. Thanks! – Firelord Feb 27 '16 at 12:03
  • I found that database on my 4.4.4 device, but the table (btopp) is completely empty (though there are paired devices). Table structure seems to confirm @Firelord's suspicion this table (just) being for xfers. So all that could be found out here to come close to the question is the first data xfer. If the device-in-question never had such (like my smart watch I've connected), it won't be listed at all. // Interesting pointer nevertheless! – Izzy Feb 27 '16 at 12:08