Data Exfiltration Over Bluetooth.

History of Bluetooth Registry Entries to investigate (MAC address of connected bluetooth devices) After that use free utility called “Dcode” to convert windows timestamp to check date and time of the bluetooth device that was connected.

“HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Devices”